Nationwide Building Society has issued an urgent security alert to thousands of its savings account holders following a significant data breach at a third-party provider. The incident has exposed sensitive customer information, putting account holders at potential risk of fraud and financial crime.
The breach occurred at a software company called Pay.UK, which manages the building society's savings account opening process. While Nationwide's own systems remain secure, the external provider's security failure has compromised customer data including names, addresses, dates of birth, and national insurance numbers.
What Information Was Exposed?
The compromised data includes:
- Full names and residential addresses
- Dates of birth and contact information
- National Insurance numbers
- Account opening dates and specific product details
Crucially, banking passwords, PINs, and card details remain secure and were not accessed in the breach, according to Nationwide's investigation.
Immediate Steps for Affected Customers
Nationwide is directly contacting all affected customers via email and post with specific guidance. The building society recommends:
- Remain vigilant for suspicious emails, texts, or phone calls
- Monitor accounts regularly for unusual activity
- Never share security details with unsolicited callers
- Consider signing up for Cifas protective registration for enhanced fraud protection
Nationwide's Response and Compensation
The mutual has apologised for the incident and is offering affected customers free fraud protection services. A dedicated helpline has been established for concerned savers, though customers are warned to be cautious of scammers potentially exploiting the situation.
This incident highlights the growing cybersecurity challenges facing financial institutions and their third-party suppliers, raising questions about data protection standards across the banking sector's supply chain.
