Monzo Customers Must Reset PIN Following Log File Blunder


Monzo Customers Must Reset PIN Following Log File Blunder (Aug 6, 2019)

British bank, Monzo, has notified thousands of its customers that they must reset their PIN immediately following a security issue that could have left accounts compromised. The company contacted 480,000 customers, a fifth of the bank’s users, after they discovered PIN details were being copied and recorded into log files in a different part of the company’s internal systems. According to Monzo, the misconfigured logs were discovered on August 2, 2019 and repaired the next day. By August 5th, the last of the logged data had been deleted. While these systems could have been accessed by unauthorized staff, there is no indication that any criminal activity may have taken place.

Recommendation: Banking information should be protected with the utmost care, and only used with vendors that you trust to keep your information in compliance with the relevant standards. Regular monitoring of financial accounts in addition to identity protection and fraud prevention services can assist in identifying potential theft of data.

Indicators of Compromise (IOCs) associated with this story can be viewed by ThreatStream users here to identify potential malicious activity.