Customers who bank online are able to transfer money between their account and that of another person: all they need is an account number and sort code.
Names, addresses, dates of birth, phone numbers and email addresses were stolen and 15,656 of the customers had bank account, including sort code, details swiped.
It is aimed at commercial providers offering sort code validation products and services which are used by organisations to manage their electronic payment processing.