Police are investigating a “significant and sustained” cyber-attack on the website of TalkTalk which could have compromised customers’ credit card and other personal details.

The telecoms provider has 4 million customers in the UK. It is the second time in the past 12 months that TalkTalk customers have been affected by data breaches.

“We are continuing to work with leading cybercrime specialists and the Metropolitan police to establish exactly what happened and the extent of any information accessed,” the company said on Thursday night after revealing the attack, which took place on Wednesday.

Its chief executive, Dido Harding, said: “We take any threat to the security of our customers’ data extremely seriously, and we are taking all the necessary steps to understand what has happened here.” TalkTalk was informing its customers immediately about the attack as a precaution, she added.

Customers criticised the firm on Twitter over the announcement. Katie Jonas, who has been a TalkTalk customer for three years, said she was “fuming” after being on hold to TalkTalk customer services for more than an hour. She said: “I’m very concerned that my bank details may have been taken but didn’t want to have to change all bank details. It’s a lot of hassle doing so but now it looks like I will have to after the disgusting customer service.

“I was angry enough being on hold that long but to then be cut off is terrible.”

She added her family each had mobile phone contracts with the company and usually got a “great service” but added the timing of the announcement was “not really acceptable”.

She said: “The late announcement is not really acceptable either but even worse is the communications. By the time people are informed who knows how much could have been stolen.”

One customer said his computer had come under attack on Thursday night.

Anyone on @TalkTalk_UK Several attempts have just been made to hack my Mac under the guise of 'Apple Virus Search' Watch out, clear history! — arthur stafford (@arthurliverpool) October 22, 2015

In December 2014 the company said it was investigating whether its customer database had been leaked after more than 100 customers said they had received calls from Indian-based scammers quoting their names, addresses and account details.

Dozens of customers have since been tricked out of thousands of pounds by fraudsters who called them pretending to be TalkTalk staff. After receiving such a fraudulent call, Graeme Smith, from Chester-le-Street in Co Durham, lost £2,815 from his Santander account.



TalkTalk has refused to accept any liability in his case, and Smith’s bank has also declined to refund the sum. Santander said that he gave personal details to the fraudsters, “thus validating and authorising the transfer of funds”.

The broadband and phone provider said in February that a third-party contractor that had legitimate access to its customer accounts was involved in the data breach. It took legal action against the supplier, thought to be based in India. TalkTalk contacted customers to warn them about the criminal activity and the Information Commissioner’s Office was also informed. It was still investigating the breach.

In August, Carphone Warehouse admitted that the details of up to 2.4 million customers may have been accessed in a “sophisticated cyber-attack”. The incident also affected TalkTalk mobile customers who had bought phones or contracts through the high-street chain. The Information Commissioner’s Office was also notified about the Carphone attack, along with Scotland Yard.

What you need to know

What data might have been exposed? TalkTalk said there was “a chance” data including credit card and bank account details may have been accessed. Other personal data could include names, addresses, dates of birth, email addresses and telephone numbers. The company has admitted “not all of the data was encrypted” but that “we believed our systems were as secure as they could be”.

What should customers do? The firm has advised customers to “keep an eye on your accounts over the next few months” and report anything suspicious to their bank or Action Fraud, the UK’s fraud reporting centre. People should also be vigilant to unsolicited calls asking for personal data or passwords, the firm said, adding it would never call to ask for bank details.

What kind of attack was it, and when did it happen? The attack took place on Wednesday and the company said it took its website down when it noticed “unusual activity” on its website. The internet provider said it did so in an “effort to protect data”. Digital security expert Benjamin Harris, from MWR InfoSecurity, suggested a denial of service attack, which sees hackers block access to a site, would not have led to personal data being compromised.

Who’s behind the breach? It is unclear at the moment. Scotland Yard’s cyber crime unit has launched an investigation to establish what happened, how much data has been breached and the source of the attack.



Why was TalkTalk targeted? As a broadband and mobile phone provider to four million customers, TalkTalk would be required to store large amounts of personal data. It is the third time this year they have fallen prey to a data breach. In August the company revealed its mobile sales site was hit by a “sophisticated and co-ordinated cyber attack” in which personal data was breached by criminals, while in February customers were warned about scammers who managed to steal thousands of account numbers and names from the company’s computers. But the company points out it is not the only victim, saying the latest attack “is by no means an isolated incident”.