From the Article "I've not heard of an attack of this nature and scale on a UK bank where it appears that the bank's central system is the target" Sounds like

From the Article "I've not heard of an attack of this nature and scale on a UK bank where it appears that the bank's central system is the target" Sounds like it's a breach from within (or at least not though compromised accounts), this would explain the lack of concern from Tesco about resting security (much to the chagrin of customers, i'm sure) and the huge numbers of affected accounts.