PIN the blame on us, says Monzo in mondo security blunder: Bank card codes stored in log files as plain text
Trendy online-only Brit bank Monzo is telling hundreds of thousands of its customers to pick a new PIN – after it discovered it was storing their codes as plain-text in log files.
As a result, 480,000 folks, a fifth of the bank's customers, now have to go to a cash machine and reset their PINs.
The bank said the numbers, normally tightly secured with extremely limited access, had accidentally been kept in an encrypted-at-rest log file. The content of those logs was, however, accessible to roughly 100 Monzo engineers who normally would not have the clearance nor any need to see customer PINs.
The PINs were logged for punters who had used the "card number reminder" and "cancel a standing order" features.
To hear Monzo tell it, the misconfigured logs, along with the PINs, were discovered on Friday evening. By Saturday morning, the UK bank updated its mobile app so that no new PINs were sent to the log collector. On Monday, the last of the logged data had been deleted.
"No one outside Monzo had access to these PINs," Monzo said in its attempt to reassure customers.
"We’ve checked all the accounts that have been affected by this bug thoroughly, and confirmed the information hasn’t been used to commit fraud."
Monzo says anyone whose PIN was exposed in the logs will be given a message instructing them to change their codes. To do that, the customer will need to go to a cash machine (app-happy Monzo has no brick-and-mortar branches) and select a new number via the PIN Services menu.
While Monzo maintains that nobody outside of the bank was able to see the codes, it would not be a bad idea to keep an eye on your account activity in case anything suspicious is spotted.
Additionally, everyone with an account at the bank is being advised to update their Android and iOS apps to make sure they have the latest versions, via which PINs are no longer fed into the log files.
The blunder is a setback for the upstart UK banking service, but fortunately for Monzo, it happened to come along in the wake of a much bigger banking privacy foul-up. With Capital One now facing lawsuits and the possibility of Congressional hearings for its mishandling of records on 106 million people, a few mishandled PINs won't get much play in the news cycle.
source theregister
Industry: Cyber Security
Latest Jobs
-
- Cyber Security Professional Services Lead | London | Immediate
- London
- N/A
-
Cyber Security Professional Services Lead London / Hybrid This role leads the delivery function for a cyber security professional services team, with ownership of utilisation, delivery quality, and team performance across multiple client programmes. You will drive billable utilisation, ensure projects are delivered on time and to standard, and manage resource planning across a complex portfolio. Acting as the escalation point for key engagements, you will also lead and develop a high-performing consulting team, maintaining strong client relationships and consistent delivery standards. Key responsibilities: Drive utilisation and delivery performance Ensure quality, on-time delivery across engagements Manage resource planning and capacity Act as escalation point for key programmes Lead and develop the consulting team Background: Currently leading a cyber or technology professional services function Recent track record improving utilisation and delivery outcomes Experience across multi-client, complex programmes Strong senior stakeholder engagement A hands-on leadership role with accountability for delivery, team performance, and commercial outcomes
-
- Cyber Security Sales | Enterprise | New Business | London
- City of London
- Uncapped OTE
-
Enterprise Account Executive | Cyber Security | UK London / UK (hybrid with client engagement) A scaling cyber security firm is hiring an Enterprise Account Executive to drive growth across large UK organisations. This role blends new business with ownership. You will open doors, create demand, and win enterprise accounts, then retain and grow those relationships into long-term, high-value partnerships. Targeting senior stakeholders at CISO, CIO, and board level, you will shape and close complex deals across cyber security, cloud, and transformation programmes. This is a strategic role. Fewer accounts, higher value, longer cycles. You are expected to build pipeline from scratch, with support around you but without reliance on inbound or marketing. A recent and consistent track record of achieving or exceeding sales targets is essential. This role requires someone currently performing at a high level in enterprise sales. UK-based, with remote working and client engagement as needed. Competitive base and uncapped earnings, with scope to build a meaningful enterprise portfolio.
-
- Cyber Security Sales | Financial Services | New Business | London
- England
- Uncapped OTE
-
New Business Lead | Cyber Security | Financial Services | London / UK UK Remote / London client travel A well-backed cyber security and technology firm is looking to hire a senior New Business Lead to drive UK growth, with a particular focus on Financial Services. This is a position for someone who knows how to open doors where others cannot. A role built around identifying opportunity, challenging incumbents, and converting that into long-term client relationships and revenue. You will own new logo acquisition across FS, working closely with leadership to shape go-to-market strategy and position across cyber security, cloud, and modernisation offerings. Full ownership of the sales lifecycle. Pipeline creation, deal strategy, negotiation, and close. The expectation is simple. Build momentum, win key accounts, and scale a function around you as revenue grows. Strong experience selling into Financial Services environments is key. Credibility at CISO, CIO, and board level matters. Remote-first, with London and client engagement as required. Competitive base, uncapped earnings, and genuine scope to build something meaningful. The successful sales person MUST have a recent history and current experinece of achieving / overachieving against sales target.