This applies to a smaller group. If your notice mentioned bank details, this page is for you. If it did not, your bank records were not among those copied — see What information of mine was involved?
What was in those records
Account holder name, address and phone number, account number, IBAN, SWIFT code and routing number — the details we held to pay you.
What this does and does not allow
Being straight with you: this is the most sensitive category in the incident after identity details, and we are not going to tell you it is nothing.
These details on their own do not let anyone take money out of your account. Bank transfers do not work that way, and the same details appear on any invoice or payment instruction you have ever sent.
What they do allow is a far more convincing approach. Someone holding them can write to you, or to people who pay you, quoting a real account number and a real address. The common fraud is not theft from your account — it is a message telling someone that your bank details have changed, and asking them to pay a different account instead.
What is worth doing
Tell your bank. Say your account details were involved in a third-party data incident and ask what monitoring or extra verification they offer. Most banks can add a note to the account.
Watch for changed-payment-details requests. If anyone contacts you claiming your bank details have changed, or asks you to send money to a new account, verify by phoning the person on a number you already had — never a number in the message.
If you invoice others, warn them. Anyone who pays you regularly should know to treat a request to change your account details as suspect until confirmed by voice.
Check statements more carefully than usual for a while. Query anything you do not recognise rather than assuming.
We will not ask you to confirm these details
We will never email, message or telephone you to confirm, re-enter or update your bank details as a result of this incident. Anything that does is not us. We are not making outbound calls at all about this — see Can I speak to someone on the phone?
If something does happen
If you see anything that looks like misuse — a payment redirected, an approach quoting your details — tell us at the notice address and we will look at your case individually.