“I am now £1,000 out of pocket after saving up for so long and there’s no information or help.” That is how Natalie Whiting, of Stevenage, described the week she has had since the Travelex cyber-attack.
She ordered over £1,000 of euros online through Tesco bank, to pick up at her local Tesco store on January 3. The money left her account and a confirmation arrived. At the store, she was told about the Travelex problem. She says she has not been able to get a refund. “It just seems to be in limbo,” she told the BBC.
Stephen Wright, from Banff in north-east Scotland, tells a similar story. His euros, ordered from Tesco bank on December 23, were also due January 3 and never came. Tesco bank told him there was nothing it could do and he would have to wait. He bought more euros elsewhere and says he is considerably out of pocket.
What Travelex has said
The company found the attack on New Year’s Eve and took all of its computer systems offline, which hit thousands of sites in dozens of countries. On Tuesday it confirmed ransomware was behind it. Cashiers at airport and high street desks have been using pen and paper to keep money moving, but online orders are affected. Partners that rely on Travelex, including Sainsbury’s, Tesco and Virgin Money, have been caught up too.
Travelex told the BBC it has sent no direct message to customers, partly because its own systems are down. Its UK website says it is closed for “planned maintenance”, and partner sites carry similar notices.
A spokeswoman said the software virus was ransomware known as Sodinokibi, or REvil. She said Travelex had acted to contain it, and that this had worked. There was some data encryption, she said, but no evidence that structured personal customer data was encrypted or that any data had been taken.
The hackers’ version
The gang told the BBC it wants $6m (£4.6m), or the company’s computer systems will be deleted and customer data sold online. It claims it got into the network six months ago and has copied 5 gigabytes of sensitive data, including dates of birth, credit card details and national insurance numbers. Travelex has not said whether it is negotiating with the hackers, and has given no date for normal service to resume.
The Information Commissioner’s Office said it had received no data breach report from Travelex. Companies must notify the regulator within 72 hours of learning of a personal data breach unless it poses no risk to people’s rights and freedoms. Under GDPR, failing to do so can bring a fine of up to 4% of global turnover. The Metropolitan Police’s cyber crime team is leading the investigation.
