Monzo has disclosed a security oversight that saw nearly 480,000 customer PINs stored incorrectly within its internal systems.

Discovered on Friday, the bug was spotted by one of Monzo’s security engineers, and meant that some login details were simultaneously stored in encrypted log files accessible by around 100 unauthorised staff.

Although an audit did not find any fraud as a result, the digital challenger bank emailed around one in five of its 2.6 million customers to inform them and advise that they should change their PIN.

In a blog post, Monzo explained that it keeps a record of PINs in order to check customers entered them correctly.

“We store them in a particularly secure part of our systems, and tightly control who at Monzo can access them.

“On Friday 2nd August, we discovered that we’d also been recording some people’s PINs in a different part of our internal systems (in encrypted log files), engineers at Monzo have access to these log files as part of their job.”

Monzo said it has since deleted the PIN information that was stored in this way, and by Saturday morning, it had released updates to the app.

“Over the weekend, we then worked to delete the information that we’d stored incorrectly, which we finished on Monday morning,” added the statement.

Share Story: