TalkTalk was recently hit with the biggest data breach fine in UK history following a clumsy, yet easy to prevent security gaffe in October 2015. The budget telco was ordered to pay a massive £400,000, after nearly 157,000 customer accounts were compromised, of which 15,000 contained sensitive financial details. One year on, following a security conference and a high-profile campaign in a tabloid newspaper, it's trying to repair the damage to its reputation with the promise of better protecting its systems against hack attacks, but there's an increasing suspicion that the UK's ISPs remain flat-footed.

"TalkTalk’s failure to implement the most basic cyber security measures allowed hackers to penetrate TalkTalk’s systems with ease," said Britain's new information commissioner Elizabeth Denham when the budget ISP was slapped with the penalty from the ICO. "Yes hacking is wrong, but that is not an excuse for companies to abdicate their security obligations. TalkTalk should and could have done more to safeguard its customer information. It did not and we have taken action."

The attack vector was via three vulnerable Web pages it had inherited from a takeover of Tiscali in 2009. Having failed to make a proper inventory of its acquisition, it had been unaware that these pages even existed, let alone enabled access to a database of customer information. In the end, it was compromised by a tactic as simple as SQL injection. In its ruling, the ICO said "SQL injection is well understood, defences exist, and TalkTalk ought to have known it posed a risk to its data." A criminal investigation into the perpetrators is ongoing, but Denham was at pains to share blame.

"In spite of its expertise and resources, when it came to the basic principles of cyber-security, TalkTalk was found wanting,” she said, adding that the "record fine acts as a warning to others that cyber security is not an IT issue, it is a boardroom issue. Companies must be diligent and vigilant. They must do this not only because they have a duty under law, but because they have a duty to their customers."

Chastened by its experience, TalkTalk told Ars that it had "redoubled its efforts to protect customers," and claims to block more than 170 million "scamming e-mails" every day. It launched a high-visibility nationwide campaign in the Sun newspaper to educate Web users about the pitfalls of the online world, and has been pushing what it calls its "four nevers"—things it and other legit providers will never do. These include never asking its customers for a full password (only two digits at a time), never asking for bank details to process refunds, never asking customers to send money through MoneyGram or Western Union, and never telling people to quote their bank account number.

TalkTalk has repeatedly refused to comment on the breach itself—in part, because it remains an active police investigation—but the firm's chief executive Dido Harding insists the scale was smaller than previously reported. There has been little word on the back-end security techniques it has been working on implementing, but at a cybersecurity conference in May, its director of corporate affairs Jessica Lennard suggested that security needs to be understood at board level, where the question should be "what risks are we taking, and how do we minimise those?"

Further to this, transparency continues to be the PR tack TalkTalk is taking. As a spokesperson told Ars, "we think people have a right to know when their data has been compromised, which isn't part of the law today. So we’re campaigning calling to make it the law that all companies have to report all big data breaches to the regulator and to their customers." Under the Data Protection Act, there is no legal obligation for data controllers to report breaches of security, but the ICO urges businesses and individuals to report serious breaches to the watchdog. But ISPs have to inform the ICO within 24 hours of a breach occurring.

Once more unto the breach

Data breaches caused by the likes of TalkTalk's embarrassing security blunder aren’t new but many agree that they’re increasing in size, scope, and frequency. 2014 was dubbed "the year of the data breach" by many infosec experts; it was the year of Heartbleed, a catastrophic crypto bug in OpenSSL that opened up two-thirds of the Web to eavesdropping, while malware suites like Backoff opened verdant new horizons for wannabe hackers. But, perhaps unsurprisingly, 2015 also earned the accolade "the year of the data breach"; US-based Identity Theft Resource Center estimates that between 176 million and 193 million personal records were ponced last year, from a total of around 730 breaches. The massive breaches that have come to light in 2016, from the likes of LinkedIn, Dropbox, and Verizon, are already putting previous years to shame, and if pundits don’t label it "the year of the data breach"—like a one-phase Chinese zodiac for the 21st century— they’re not doing their jobs at all.

Such stories are now routinely making headline news far beyond the tech bubble. Witness the recent coverage of Yahoo's megabreach, after the ailing Web pioneer admitted it had been the victim, in late 2014, of what’s likely to be recorded as the largest data breach in history so far. More than half a billion accounts were compromised in what Yahoo is blaming on a "state-sponsored actor," which is believed to have opened the gates to all sorts of user information up to and including customers’ "names, e-mail addresses, telephone numbers, dates of birth, hashed passwords (the vast majority with bcrypt)" and "encrypted or unencrypted security questions and answers." It dwarfs the MySpace breach in size (360 million accounts), and eclipses the LinkedIn leak in visibility—although it’s hard to imagine a breach that will ever top the Ashley Madison dump for sheer schadenfreude.

An investigation into the Yahoo breach is only just getting started, spearheaded by American law enforcement agencies, with Russia and China fingered as the prime suspects. An estimated eight million Brits are affected, and the ICO—which can apply a fine of up to £500,000 if Yahoo has monumentally screwed up—has promised to ask "serious questions."

"The vast number of people affected by this cyber attack is staggering and demonstrates just how severe the consequences of a security hack can be,” said commissioner Denham. "The US authorities will be looking to track down the hackers, but it is our job to ask serious questions of Yahoo on behalf of British citizens."

British ISPs learn the hard way

It’s not just Web companies being hit, however. Many firms in the UK's telecoms market have a less than glorious record on cybersecurity. Carphone Warehouse was hit last year, with 2.4 million accounts compromised and encrypted credit card details for 90,000 customers stolen in a "sophisticated" attack.

Direct breaches aren’t the only way for criminals to get their hands on juicy user data, either. Bundles of O2 customer data were found for sale on the darknet in July of this year, in a buy-five-get-two-free deal, apparently leaked as a result of a technique known as credential stuffing. Username and password combinations hacked from the gaming site X-Split in 2012 were reused by enterprising blackhats on other targets, like O2, which had more worth to identity thieves. In thousands of cases, users hadn't bothered to use different usernames or passwords for log-ins, allowing hackers to access their accounts and get hold of valuable personal information like their dates of birth and phone numbers.

The companies Ars spoke to admitted that they were increasingly aware that compromised dumps of their data were being traded on this famously hard-to-police area of the Web, and several privately admitted that they had security teams searching the darknet and working out solutions. However, as one source said, "we would rather you didn’t highlight that so the criminals don’t start to become more difficult to track!"

Days after TalkTalk hit the news for all the wrong reasons, Vodafone suffered a breach when the accounts of 1,827 customers were compromised, revealing their names, mobile numbers, bank sort codes, and the last four digits of their bank accounts. It reported the attack promptly, notified the banks, and claimed at the time that "only a handful of customers have been subject to any attempts to use this data for fraudulent activity." Since then the firm has introduced basic in-account security measures; it no longer shows users their own dates of birth when logged in, and it redacts other important personal information, so even if hackers do log in, they apparently can’t find much useable information.

On the record, Vodafone told Ars that it had been forced to up its game. A spokesperson said: "We use a blend of preventative, detective, and corrective controls to protect our customers' information, which we update regularly as the threat to our customers changes. We implemented an innovative new investigation process at the end of last year, which enhanced our ability to identify risks to customers so that we can proactively flag any potential security issues to customers before they become a problem."

BT and O2 declined to discuss their basic security procedures when asked by Ars. None of the other UK ISPs we spoke to were willing to provide commentary on what they are doing to mitigate the risks. And while the British public appear to have more awareness of the risks of loose data, more criminals seem to be chancing their arm too; tentative figures in the summer from the Office of National Statistics showed just shy of four million crimes involving fraud or computer misuse during the previous year—a number that's very definitely growing.