Freshfields Bruckhaus Deringer has advised Tesco Bank on its agreement with the Financial Conduct Authority (FCA) to pay a £16.4m fine for a "largely avoidable" 2016 cyberattack.

The FCA alleges that cyberattackers "exploited deficiencies in Tesco Bank's design of its debit card, its financial crime controls and in its financial crime operations team", with the attackers pocketing £2.26m and leaving the bank's personal current account holders vulnerable.

Freshfields  fielded a team led by global investigations partner Ali Sallaway, who has experience defending actions brought by the Serious Fraud Office and the FCA, alongside commercial disputes partner Samantha Trevan.

Following an investigation, the FCA found that Tesco Bank "failed to exercise due skill, care and diligence", attributing the breach to several factors, including the bank's failure to take appropriate action to prevent the foreseeable risk of fraud, and to "respond with sufficient rigour, skill and urgency".

FCA executive director of enforcement and market oversight Mark Steward said: "The fine the FCA imposed on Tesco Bank reflects the fact that the FCA has no tolerance for banks that fail to protect customers from foreseeable risks. In this case, the attack was the subject of a very specific warning that Tesco Bank did not properly address until after the attack started. This was too little, too late. Customers should not have been exposed to the risk at all."

The FCA granted the bank two successive 30% discounts, reducing a potential £33.5m fine to £16.4m, following the bank's "high level of cooperation", providing full compensation to its customers and reaching an early settlement.

Freshfields has recently taken on a number of key mandates for Tesco, last year acting alongside Clifford Chance in the supermarket giant's £3.7bn acquisition of food wholesale operator Booker Group, and partnering with Kingsley Napley as the company reached a £129m settlement with the SFO to avoid prosecution for overstating its 2014 profits.