Travelex’s outage was every white-label bank’s outage
When ransomware took Travelex offline, banks that sold its travel money under their own brands had no service and little to say. White-label dependencies carry the bank’s reputation, so they need the bank’s controls: communication, contract terms and concentration planning.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On New Year’s Eve 2019, the foreign exchange company Travelex was hit by ransomware widely attributed to the Sodinokibi (REvil) group. It took its websites and many internal systems offline, and staff in some locations reverted to manual processes. During the first full week of January 2020, the effect spread beyond Travelex itself. Several large UK banks and supermarket banks that offered travel money through Travelex under their own names had to tell customers that online currency orders were unavailable. Public reporting at the time said the attackers had demanded a ransom, and security researchers pointed to unpatched remote access servers as a likely entry point; Travelex did not confirm those details that week. Services were restored gradually over the following weeks.
The Travelex incident is usually remembered as a ransomware story. For the banks that resold its service, it was a procurement story. They had outsourced a customer-facing product to one specialist, sold it under their own brand and managed the arrangement as a commercial partnership. When the partner failed, three costs landed on them at once: a visibility cost, a contractual cost and a concentration cost. Each needs a different control, and each control has a price that is easiest to pay at selection or renewal.
The visibility cost
White-labeling works because the customer sees one brand. That is also why it fails badly. Customers who had ordered currency from their bank did not know Travelex was involved, so the outage read as the bank’s outage. Branch and contact center staff had to explain a dependency the customer had never been told about, often with no more information than the public had.
Three gaps made this worse. Front-line scripts did not exist, so each branch improvised. Status information came from the partner’s press statements, not from a direct operational channel. And nobody had agreed in advance what customers would be offered instead, such as a refund, a waiver of fees or a referral to another provider.
The control is a short playbook for each white-label product. It names who inside the bank owns customer communication and sets the message for the first 24 hours. It lists the remedies front-line staff can offer without escalation, and the partner contact who will give the bank status updates. It costs a few days of work per product. A useful test is whether the contact center could brief its agents within an hour of a partner outage. If the honest answer is no, the bank is carrying reputational exposure that appears on no risk register.
Complaint handling is part of the same picture. Customers who could not collect currency before a trip, or who were unsure whether their order had gone through, complained to the bank whose name was on the product. Complaint teams need a way to tag such cases to the partner incident, so the bank can see the scale of harm, apply remedies consistently and recover costs where the contract allows. Without that tag, a partner outage disappears into general complaint statistics and never reaches the vendor review.
The contractual cost
Commercial agreements for niche services are often negotiated by business lines and focused on revenue share, branding and volume. Incident notification timelines, forensic cooperation, audit rights, minimum security controls and the right to suspend or exit are easy to under-specify when the service is seen as peripheral. In a ransomware event those clauses are the only tools the bank has. Without them, it waits for news like everyone else.
Specific terms matter more than general ones. A useful agreement sets a notification window measured in hours. It requires the partner to share investigation findings that affect the bank’s customers. It gives the bank the right to see evidence of controls, such as patching of internet-facing systems and offline backups. And it defines who pays for customer remediation when the partner causes the harm.
The practical fix is to tier white-label and embedded partners by customer impact rather than contract value. A low-spend arrangement that touches customers directly should carry the same incident, security and exit terms as a core processor. Vendor management teams should be able to list which customer-facing contracts lack those terms, with a date to close each gap. Partners will price stronger terms into their fees. That price is the cost of the product, and the business case should carry it.
The concentration cost
The third cost was systemic. Several brands relied on the same provider, so a single compromise removed the service across a meaningful part of the market at once. No single bank’s due diligence would have revealed that. Each assessed Travelex in isolation, and each might reasonably have concluded that the provider was competent and well established.
Concentration risk is a market-level property, and a bank can only manage its share of it. That starts with knowing which critical and customer-facing services depend on providers that many peers also use. Industry bodies, examiners and the provider itself can often confirm how widely a service is shared. The bank then has three options for each such service: pay for a second provider, maintain a manual fallback, or accept the risk explicitly at an appropriate level of management.
Shared providers also tend to be specialists whose security budget is sized for a niche business, not for the combined exposure of every brand that depends on them. Their clients can sometimes assess them jointly, or rely on a common independent assessment, which is cheaper and more searching than each bank running its own questionnaire.
Each of these choices has a cost, and acceptance is sometimes the right answer. What a board should see is a list of products sold under the bank’s brand but operated by someone else, with an owner, a fallback decision and the date that decision was last reviewed. For most institutions, assembling that list is a modest exercise that turns up at least one surprise.
With hindsight
Travelex restored services over the following weeks, but the business did not recover its footing. The pandemic collapsed international travel within months, and in August 2020 parts of the group entered administration in the UK with substantial job losses. In April 2020 the Wall Street Journal reported that Travelex had paid the attackers about $2.3 million in bitcoin. Whether the attack or the pandemic did more damage is hard to separate, but the combination showed how a provider weakened by one shock can fail under the next.
Regulators have since moved firmly to the view that third-party failures are the regulated firm’s problem. In the UK, where the affected banks sat, the operational resilience rules took effect in March 2022 and required firms to stay within impact tolerances for important business services by March 2025, whoever operates them. The US banking agencies issued final interagency guidance on third-party risk management in June 2023. The EU’s Digital Operational Resilience Act has applied since January 2025, with explicit expectations on ICT concentration and exit planning. The questions Travelex raised informally are now asked formally in examinations.