Energy provider Npower has taken down its mobile app following a cyber attack that exposed some customers' bank details.
It is understood hackers stole personal contact details, dates of birth, addresses and some financial information, including bank sort codes and the final four digits of customers' account numbers.
They were unable to access the full account numbers, however.
It is unknown how many accounts were affected by the breach, say MoneySavingExpert.
Npower — which is one of the UK's 'Big Six' energy companies — said hackers accessed customers' accounts using stolen login credentials.
The firm has not revealed when the cyber attack took place.
An Npower spokesperson said: “We've contacted all affected customers to make them aware of the issue, encouraging them to change their passwords and advice on how to prevent unauthorised access to their online account.
“We immediately locked any online accounts that were potentially affected, blocked suspicious IP addresses and took down the Npower app. We also notified the Information Commissioner’s Office [ICO] and Action Fraud.
“As part of Npower’s existing wind-down plans, the mobile app was already due to be taken down. As part of this plan, we have contacted all active app users to let them know that they can continue to self-serve on npower.com.
“Protecting customers’ security and data is our top priority and our robust defences helped us to identify this recent attack. It’s important we all continue to stay secure online and urge customers to avoid reusing the same password across multiple websites.”
The ICO — the UK's data watchdog — confirmed it had been contacted by the company, saying: “Npower has made us aware of an incident affecting their app and we are making inquiries.”
