Sampo Bank CEO apologises for electronic glitches

Sampo has to contend with Danske Bank vulnerabilities

print this

Ilkka Hallavo, CEO of Sampo Bank, issued an apology on Thursday evening to customers who had suffered from technical problems linked with the introduction of a new online banking system.
     The apology by the CEO showed a new approach by the bank on the matter. Previous comments were made by the head of communications, who offered no apologies.
     
The Bank of Finland and the Financial Supervision Authority have discussed how possible monetary losses suffered by customers should be compensated. Sampo has asked that compensation applications be submitted in writing, indicating the basis for the request and the amount of money involved.
     Hallavo would not say if Sampo Bank would offer any monetary compensation beyond the actual monetary losses, for the aggravation that may have been caused. The law only requires the reimbursement of actual financial losses.
     
Hallavo says that most of the problems were linked with debit cards issued by the bank.
     Some of the cards stopped working in a situation in which a customer had been sent a new card. Contrary to previous practice, Sampo Bank cancelled the old cards immediately; previously old cards had remained operational for a time even after a new card had been sent to the customer.
     "We have reactivated the old cards", Hallavo says.
     The problems with the cards led to a flood of telephone calls to the bank's customer service lines.
     There were also "challenges" on Tuesday on Sampo Bank's website and its online banking service, when the pages jammed up under the flood of customer traffic.
     Hallavo says that the web pages now work normally.
     
At the new parent company of Sampo Bank, the Danish Danske Bank, IT manager Peter Schleidt insists that the vulnerabilities in data security that were detected at Sampo Bank have not endangered online customer security.
     "The two vulnerabilities that have been out in public have been fixed", he says.
     
The information system of Sampo Bank was integrated with that of Danske Bank during Easter weekend.
     Since the integration, cross site scripting (XSS) vulnerabilities have been found on the new web pages, which can be used by criminals looking for credit card numbers and other personal information of bank customers.
      Mikko Hyppönen, head of research at the online security company F-Secure, says that there are still XSS vulnerabilities in Sampo Bank's new online banking system.
     
Peter Schleidt says that the vulnerabilities are not a risk if the customer follows instructions.
     Sampo Bank and Danske Bank now share the same platform, which means that the same vulnerabilities have affected Danske Bank's online services for years.
     "That is a problem of a common platform. On the other hand, problems can be fixed quickly, because they are fixed everywhere at the same time", Schleidt says.
     He points out that it is not surprising as such that problems arose during such a massive project.
     "I am sorry about the difficulties that this has caused our customers", Schleidt said, asking for understanding. He said that the problem is being worked on, and the situation is improving by the hour.
     Schleidt says that it was a very big surprise when the bank's website crashed for an hour and a half just as the new system was supposed to open up to the customers.
     "I did not expect it, as we had done the stress tests." He said that Sampo Bank had to resort to an "emergency home page".
     
Schleidt recalls that there were problems of a different kind some years back when the data systems of Danske Bank and the banks that it acquired in Ireland were integrated. At that time, a major issue was that Ireland was somewhat behind Denmark in the use of information technology.
     "People were not used to personal computers. In Finland the situation is the opposite. Sampo Bank and Finland are very advanced in information technology. We have benefitted from that very much.


Previously in HS International Edition:
  Sampo Bank online problems continue (27.3.2008)
  Serious problems with launch of new online service of Sampo Bank (26.3.2008)

Helsingin Sanomat