Telecoms giant receives ransom demand and reveals stolen data of up to 4 million customers may not have been encrypted

TalkTalk is facing increasing criticism after belatedly admitting it was the victim of a “significant and sustained” cyber-attack that has led to the theft of the credit card and bank details of up to 4 million customers.

The telecoms giant warned that the stolen customer data may not have been securely encrypted and that it had received a ransom demand from someone who claimed to have carried out the corporate hack.

TalkTalk breach: what to do if you're a customer Read more

During a round of media interviews on Friday, Talk Talk’s chief executive, Dido Harding, said: “I personally received a contact from someone purporting – as I say, I don’t know whether they are or are not – to be the hacker, looking for money.”

Asked by the BBC whether customers’ bank details had been encrypted by TalkTalk, she said: “The awful truth is, I don’t know”.

“With the benefit of hindsight, were we doing enough? Well, you’ve got to say that we weren’t and obviously we will be looking back and reviewing that extremely seriously.”

Customers were being advised to contact their bank and Action Fraud, the national fraud and internet crime reporting centre, if they noticed unusual activity on their accounts. They were also urged to change their TalkTalk account passwords and any other accounts that used the same passwords.

It is the company’s third major security breach in the past year. In December 2014, customers received India-based scam calls after the first breach. It happened again in February, with TalkTalk customers being subject to further scams despite the company describing the information that was stolen in the breach as limited and non-sensitive.

The information commissioner, who is already investigating the previous two security breaches, criticised TalkTalk for taking more than 24 hours to tell his office what had happened. Christopher Graham told BBC Radio 4’s World at One: “I wish we had heard a little bit earlier and we could have been more ‘out there’ giving advice to consumers about what they need to protect their personal information.”

Harding said the firm acted as promptly as it could because it was not initially aware that a hack was taking place. “On Wednesday lunchtime, all we knew was that our website was running slowly and that we had the indications of a hacker trying to attack us,” she said.

TalkTalk criticised for poor security and handling of hack attack Read more

Experts said it was conducted by a denial of service (DDoS) attack.



Tim Smith, partner and head of technology, media and telecoms at the insurance law firm BLM, said: “These types of attacks are becoming increasingly common in the UK and it is not at all unusual to find that hackers use an initial DDoS to distract a business’s IT team and then follow up with a second attack trying to steal information.



“This underlines how at risk businesses are and how important it is to take all precautionary measures to protect customer data.”

TalkTalk Mobile customers were affected by an attack on Carphone Warehouse systems in August, in which the personal information of up to 2.4 million customers was stolen.

The Information Commissioner’s Office can impose monetary penalties for data breaches, capped at £500,000, as well as enforcement notices. While there is no specific requirement for firms to encrypt data, Graham indicated that there could be a bigger penalty from the watchdog if it believed the customer information on TalkTalk’s systems was not secure.

Referring to the £250,000 penalty imposed on Sony Corporation after it was found that leaked PlayStation customer data had not been encrypted, he said: “People have got to take this seriously”.

Harding apologised to customers for the latest cyber-attack, but said the three breaches in the past year were unrelated. TalkTalk shares closed down 4% on Friday.

Harding said the attack should be treated as a crime. “Whether it is the US government, Apple, [or] a host of companies, cybercrime is something we all need to get better at defending ourselves against,” she said.



The Metropolitan police cybercrime unit has launched an investigation into the breach, although there was little firm information available about the hackers.

Adrian Culley, a former detective at Scotland Yard’s cybercrime unit, said the hack appeared to be the work of Islamist militants after a group claimed responsibility for the attack in the name of Allah. He told BBC Radio 4’s Today programme: “It appears at face value to be Islamic cyberterrorism.”

The claim could not be verified, but Culley pointed out that a group calling itself “TalkTalk Hackers” published what it claimed was a sample of dozens of email addresses and national security numbers as proof of the attack.



The group posted the message on the site Pastebin, which is often used by hackers for publishing large amounts of information. The message used the rhetoric of Islamist militants to justify the hack, saying: “We will teach our children to use the web for Allah … your hands will be covered in blood … judgment day is soon”.

Prof Peter Sommer, from De Montfort University’s cybersecurity unit, told the Today programme: “It seems to me the suggestion that these are Islamic terrorists who are perpetrating it is unlikely, [though] not impossible.

“One has to look at what is probably the most likely outcome. One of them is an extortion attempt; since they have gone public I suspect that’s not going to work. The other one is just to get hold of the credit card information, get hold of the personal information.”