TalkTalk Website Hack risks Customer Data

TalkTalk has come under the third cyber attack in 2015, putting its 4 million customers in the UK at risk of data breach.

The mobile and broadband provider confirms the attack happened in the morning of October 21, 2015.

They took the steps to shut down their website by lunchtime after noticing ‘unusual activity’.

An official announcement of its latest hack was made on the evening of October 22, 2015.

TalkTalk states a ‘significant and sustained cyberattack’ has affected their website and database.

Customers are warned in a formal notice that it is possible that the following personal information may have been accessed via illegal means, because ‘not all of the data was encrypted’:

• Names
• Address
• Dates of Birth
• Email Address
• Telephone Numbers
• TalkTalk Account Information
• Credit Card Details and/or Bank Details

Their statement continues: “We are continuing to work with leading cybercrime specialists and the Metropolitan police to establish exactly what happened and the extent of any information accessed.”

The company’s CEO, Dido Harding, says: “We’re taking the precaution of contacting all of our customers because there is the potential that bank details and credit card details have been stolen, but at this stage I can’t be certain that’s the case.

“I should say firstly I’m a customer myself, I’m a victim myself.

“I’m extremely sorry for all of the frustration and the concern and worry this will be causing.”

She reassures: “We take any threat to the security of our customers’ data extremely seriously, and we are taking all the necessary steps to understand what has happened here.”

Speculations of the motivation behind the malicious attack vary. Adrian Culley, a cyber security consultant and former Scotland Yard detective, states an online ‘Russian Islamist group’ has claimed responsibility.

Meanwhile, BBC’s business editor Kamal Ahmed believes the hack could be an ‘extortion attack’, where ransoms would be demanded in Bitcoins.

Tom Cheshire, Sky News’ Technology Correspondent, explains how TalkTalk’s website suffered from a Distribution Denial of Service.

He says: “(It’s) when a network is flooded with requests which it can’t respond to in time, so it shuts down.

“At the same time they’ve used that as a cover to go in and steal customer details.

“The credit card numbers were only partially encrypted, which means at least the last four numbers of the credit card were available to attackers.

“That doesn’t sound like a lot but it is enough to use for useful fraud purposes if you’re a criminal.”

TalkTalk offers one of the cheapest mobile and broadband deals in the UK, and is also known as the sponsor for popular reality TV show, The X Factor.

In light of the recent attack, in addition to seeing its share price plunge by 10 per cent, TalkTalk is also facing a serious backlash of customer dissatisfaction.

It appears not all of them have been informed of the significant data breach.

No #talktalk I don’t feel like, as a customer, you’ve kept me informed at all. Why do I have to find this out via the ten o’clock news?!

— Sonikmummy (@sonikmummy) October 22, 2015

I see #talktalk has been hacked again, seriously need to go to another provider, especially as I find out via #BBC and not talk talk

— Lan (@LaniCDF) October 22, 2015

As it remains unclear how many of its 4 million clients have been affected, many would take the steps to protect themselves by changing their TalkTalk account log in details.

However, the company’s support handle on Twitter advises they can ‘only change your password in My Account which isn’t available as a precaution while investigations continue’.

This is the third instance in 2015 where TalkTalk has been hit by cyber criminals. In February 2015, scammers managed to access their internal systems and contact its customers attempting to steal their bank details.

In August 2015, their website experienced a ‘sophisticated and co-ordinated cyber attack’ as a chain effect of hackers going after Carphone Warehouse.

TalkTalk is currently offering help online for extended hours and a continuous update on the investigation on its website and social media.

The company urges all customers to monitor their banking activities over the next few months, and contact Action Fraud on 0300 123 2040 if they notice any suspicious movements.