Denial of service attacks are traditionally perpetrated by customers with a grudge or by blackmailers, but there is no indication from Lloyds that a ransom demand was received.

It’s likely that systems engineers blocked all internet traffic from overseas locations where the attacks seemed to be coming from, halting the disruption at least temporarily before the attackers switched their activity elsewhere.

Source: BBC News