US arm of RBS faces £141m lawsuit after admitting hackers breached security system

Share this article

PART of Royal Bank of Scotland's operations in the United States faces a $200 million (£141 million) class action lawsuit after admitting hackers had breached security on its computer systems, it emerged yesterday.

The latest blow for RBS comes after a class action was filed in New York last month, accusing the bank and its directors of allegedly misleading investors when American shares were issued in 2007.

During a 30-minute period last November, thieves used 100 cloned pre-payment cards to allegedly withdraw a total of $9 million from 100 cash machines in 49 cities around the world.

RBS WorldPay - the payment processing arm of Citizens Bank - said customers will not be liable for the losses against their accounts but American lawyers are worried that thieves may use stolen social security numbers from RBS WorldPay's computer systems to commit further fraud.

No UK account holders were affected by the security breach, but RBS WorldPay admitted that the social security numbers of 1.1 million Americans may have been accessed.

In total, RBS WorldPay – which is based in Atlanta, Georgia – said 1.5 million cardholders had been affected by the security breach.

The Federal Bureau of Investigation (FBI) is investigating and has issued photographs of some of those accused of using the cloned cards at ATMs.

Jamie Sheller, of Philadelphia legal firm Sheller PC, said the alerts were not enough and has filed a suit in Atlanta against RBS WorldPay. Ms Sheller claims the company failed to protect its customers and is suing for compensation for the inconvenience all its customers have suffered in changing their banking arrangements.

She said: "We have customers calling us every day with new stories of how they have been affected beyond simply the withdrawals from their account.

"RBS WorldPay has offered ID theft protection for a year for some of their customers. It isn't clear on what basis they selected the lucky few but even for those, one year isn't enough.

"Organised criminals now have social security numbers and payroll details for hundreds of thousands of customers. We are filing a suit to ensure they (RBS] provide ID theft insurance and ID theft alerts for all those affected for six or seven years."

Ms Sheller is working in collaboration with two other firms and expects the case to reach court within the next three months. She added: "I expect RBS WorldPay lawyers will attempt to have the suit dismissed on grounds of no actual loss, but the truth is these criminals are really bad guys and the customers affected will feel under siege for years to come. Paying back only cash losses isn't enough."

A spokesman for RBS WorldPay last night said: "Cardholders will not be responsible for any unauthorised transactions on their accounts as a result of this highly sophisticated cyber-intrusion. To our knowledge, no actual identify theft has occurred as a result of this situation."


A FORMER QC taking legal action against the Royal Bank of Scotland today said he hoped the battle will answer questions about the financial giant's downfall. Ian Hamilton, 83, is taking RBS to court with a claim the bank was insolvent when it sold him shares. The former QC alleges that the bank concealed the "true state" of its finances when he bought 640 shares at 2 a share in the bank's rights issue last year. RBS shares are currently valued at just over 20p.

RBS has said it will post a loss of about 28 billion when it reveals its full-year results later this month.

Back to the top of the page