Barclays' web bank suffers security breach

Barclays has reopened its online banking service after an embarrassing security breach forced it offline yesterday afternoon.

The shutdown of one of the UK's biggest internet banking services happened after four of the bank's customers reported that they were able to see other customers' account details. The discovery of the problem followed a software upgrade carried out on Saturday.

However, the bank has sought to reassure customers by insisting that despite being able to see these details, it would not have been possible to carry out transactions using those accounts.

The site was offline from 3.30pm yesterday until 7pm, when the service reopened using the older software. The upgraded software, which was designed to improve transaction processing, is now under review.

Barclays has 1.25 million online customers, some 85,000 of whom used the service between the time of the upgrade and the suspension.

A spokeswoman for the bank said: "The security of our customers is paramount. We reinstated online banking using the old service. We will not re-release the upgrade until we're satisfied problems are rectified."

She added that no customers had lost money because of the incident, and that the bank has launched an investigation to determine the root cause of the software problem.

The Barclays glitch comes just days after energy company PowerGen admitted that thousands of its customer account details were exposed on its website.

Consumer groups said security breaches like these are holding back ecommerce. Anna Bradley, director of the National Consumer Council, said: "Our research shows that trust is a serious concern for consumers. Barclays' problems further undermine consumer confidence and until leading providers, such as Barclays, address the problems of security, privacy and customer service, ecommerce will not take off."

Barclays is not the first online bank to suffer problems with its website. Egg and cahoot have both experienced troubles, and the overall standards of internet banking are being monitored by the Financial Services Association (FSA).

FSA chairman Howard Davies spoke in June this year of the need for banks to get new launches and upgrades right first time or suffer damage to their reputations. An FSA spokeswoman said today that it was talking to all banks about their internet operations before the Financial Services and Markets Act comes into effect in 2001. Banks will then have to provide the FSA with details of the number and types of complaints they receive.

Currently, the UK banking ombudsman service, which mediates disputes between customers and banks, deals with around 10,000 complaints a year, only a handful of which are related to online banks.

A spokesman at the Department of Trade and Industry told vnunet.com: "This is a matter for Barclays. However, this does underline the need for rigour in managing change to prevent information security breaches. We have regular contact with Barclays' information security specialists and we will explore the extent to which the lessons learnt can be put to wider use."