Skip to content
Breach Index · running record

Barclays data breach history (2016-2026): vendor claims, card fraud via Ticketmaster and an ICO probe

Barclays has not disclosed a breach of its own systems in the last ten years in the sources we read. What it has faced is a 2024 hacker claim against one of its software vendors, a 2018 retailer breach that put tens of thousands of Barclays cards at risk, and a 2020 privacy investigation over how it monitored staff. Each item below is dated and sourced.

Short answer

Was Barclays hacked?

We found no confirmed breach of Barclays’s own systems from 2016 to 2026 in the sources we read. In May 2024 the hackers IntelBroker and Sanggiero claimed to have stolen data from a contractor serving Barclays and HSBC. Barclays said it was “aware of a reported cyber incident impacting a software vendor to Barclays” and that there was “no indication of any impact to Barclays’ systems or client data at this time.”

Barclays customers were hit indirectly in 2018, when attackers injected code into a chatbot on Ticketmaster’s payment page. The UK Information Commissioner’s Office (ICO) penalty notice, as summarised by law firm Hunton Andrews Kurth, says about 60,000 payment cards of Barclays customers were compromised. Ticketmaster, not Barclays, was fined £1.25 million.

Separately, in August 2020 the ICO confirmed it was investigating Barclays’s alleged use of employee monitoring software. We found no published outcome.

Timeline at a glance

  1. Nov 2025 – Jan 2026Barclays not named in coverage of the SitusAMC or Fried Frank vendor breaches. (Bank Info Security)Not a breach
  2. 10 May 2024Barclays confirms a “reported cyber incident” at a software vendor; no sign of impact on its systems or client data. (The Cyber Express)Reported
  3. 8 May 2024IntelBroker and Sanggiero claim data from a contractor to Barclays and HSBC. (Hackread)Unverified claim
  4. 13 Nov 2020ICO fines Ticketmaster £1.25M; ~60,000 Barclays customer cards compromised in its 2018 breach. (Hunton (ICO notice))Confirmed
  5. 10 Aug 2020ICO confirms an investigation into Barclays’s alleged use of staff monitoring tools. (The Register)Reported

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Barclays incident timeline, in detail

Confirmed = acknowledged by Barclays, a regulator filing or a court. Reported = credible reporting Barclays has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Apr – May 2024Unverified claimThird-party / software vendor (claim)

Hackers claim data from a software vendor serving Barclays and HSBC

What happened. On 8 May 2024 the hackers IntelBroker and Sanggiero posted on BreachForums that they had breached a third-party contractor of Barclays and HSBC in April 2024. Hackread reported the claimed haul as database and SQL files, source code, certificate files, compiled JAR files, JSON configuration files and email addresses (over 500,000 claimed, but only 81 unique after removing duplicates). The Cyber Express said preliminary analysis pointed to Baton Systems, a post-trade processing platform; Baton did not comment.

Impact. Barclays said it was “aware of a reported cyber incident impacting a software vendor to Barclays” and saw “no indication of any impact to Barclays’ systems or client data at this time.” The Cyber Express noted no evidence that customer data had leaked. The vendor has not been publicly confirmed.

Sources: The Cyber Express, 10 May 2024 · Hackread, 9 May 2024

Feb – Aug 2020ReportedRegulatory / data protection

ICO investigates Barclays over staff monitoring software

What happened. The Register reported that in February 2020 Barclays trialled software, reportedly from Sapience Analytics, that measured how long staff spent at their desks and allegedly let managers single out individuals. After staff complaints Barclays reportedly halted the monitoring and referred the matter to the ICO. In August 2020 the ICO said: “We have an ongoing investigation relating to Barclays’ alleged use of employee monitoring tools.”

Impact. An employee-privacy matter, not a data theft. We found no published ICO outcome or fine.

Sources: The Register, 10 Aug 2020

Feb – Jun 2018ConfirmedThird-party / merchant breach

Ticketmaster chatbot breach compromises about 60,000 Barclays customer cards

What happened. Attackers injected malicious code into a chatbot supplied by Inbenta on Ticketmaster UK’s payment page from February 2018 until it was disabled in June 2018. This was Ticketmaster’s system, not Barclays’s. The ICO fined Ticketmaster UK £1.25 million on 13 November 2020.

Impact. Per the ICO penalty notice as summarised by Hunton Andrews Kurth, “approximately 60,000 payment cards of Barclays Bank customers were compromised as a result of the breach.” Card data entered at checkout was exposed; affected cards faced fraud and replacement.

Sources: Hunton Andrews Kurth, 16 Nov 2020

Where the reports disagree

  • Which vendor in 2024? Barclays referred only to “a software vendor”. The Cyber Express said preliminary analysis suggested Baton Systems; Baton did not comment, so the vendor is unconfirmed.
  • How much data in 2024? The hackers claimed over 500,000 email addresses; Hackread found only 81 unique ones after removing duplicates.

The pattern across the record

The exposure has come through other companies’ systems

The 2024 claim targeted a software vendor and the 2018 card losses came from a retailer’s payment page. In both cases Barclays customers or data were at risk without Barclays’s own network being breached.

Insider and paper-trail history predates the window

Before 2016, files from the closed Barclays Financial Planning unit were sold and later found on a memory stick (2014-2015). That case shaped how UK regulators view banks’ control of legacy customer records.

Privacy enforcement can come from inside the firm

The 2020 ICO investigation was about how Barclays monitored its own staff, a reminder that data protection risk covers employees as well as customers.

What it means for Barclays customers — and what to do

Nothing here shows Barclays losing customer data from its own systems. The practical risks for customers are card fraud after a retailer breach and scams that use a bank’s name after a headline.

  1. 1.Check card statements after any retailer breach notice

    If a shop or ticket site tells you your card was exposed, look for small test charges and ask Barclays to replace the card rather than waiting for fraud.

    Breach notice decoder
  2. 2.Treat “Barclays security team” calls as suspect

    Hang up and call the number on your card. Barclays will not ask you to move money to a “safe account”.

    Voice-clone fraud checklist
  3. 3.Use strong sign-in for online banking

    Use the app’s passcode or biometric sign-in and do not reuse your banking password elsewhere.

    Phishing-resistant MFA planner

CISO takeaways

Have a vendor-breach intake ready

When a hacker names your supplier, you need answers on data, access and timing within hours.

Third-party breach checklist
Rehearse a vendor breach

Practise the calls, the questions to the vendor and the decision on whether to notify.

Vendor Breach Lab
Score software and post-trade vendors

Vendors holding source code, certificates or transaction records deserve the same scrutiny as data processors.

Vendor Risk Scorecard

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.Barclays and HSBC bank data breach claimed by hacker duo — The Cyber Express, 10 May 2024
  2. 2.IntelBroker hacker leaks alleged HSBC & Barclays bank data — Hackread, 9 May 2024
  3. 3.ICO fines Ticketmaster £1.25 million for security failures — Hunton Andrews Kurth, 16 Nov 2020
  4. 4.Barclays under investigation over employee monitoring — The Register, 10 Aug 2020
  5. 5.Major US banks gauge their exposure to SitusAMC breach — Bank Info Security, 24 Nov 2025
  6. 6.After Goldman, JPMorgan discloses law firm data breach — SecurityWeek, 13 Jan 2026

Frequently asked questions

Was Barclays hacked?

We found no confirmed breach of Barclays’s own systems from 2016 to 2026. In May 2024 hackers claimed data from a software vendor to Barclays; Barclays confirmed a reported incident at the vendor but said it saw no impact on its systems or client data.

Is there a Barclays data breach in 2024?

There was a claim, not a confirmed Barclays breach. IntelBroker and Sanggiero said they had stolen files from a contractor to Barclays and HSBC. Barclays said there was no indication of impact on its systems or client data.

Were Barclays cards affected by the Ticketmaster breach?

Yes. The ICO’s 2020 penalty notice against Ticketmaster UK says about 60,000 Barclays customer cards were compromised by the 2018 chatbot attack on Ticketmaster’s payment page. Ticketmaster was fined £1.25 million.

Was Barclays fined by the ICO?

We found no ICO fine against Barclays in 2016-2026. The ICO confirmed in August 2020 that it was investigating Barclays’s use of staff monitoring tools; we found no published outcome.

Was Barclays affected by the SitusAMC or Fried Frank breaches?

Barclays was not named in the coverage we read. Reporting on SitusAMC named JPMorgan Chase, Citi and Morgan Stanley; the Fried Frank law firm breach named JPMorgan Chase and Goldman Sachs.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Barclays. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.