Website attack affecting our customers

We are very sorry to tell you that on Thursday 22nd October a criminal investigation was launched by the Metropolitan Police Cyber Crime Unit following a significant and sustained cyberattack on our website on Wednesday 21st October. The investigation is ongoing, but unfortunately there is a chance that some of the following data may have been accessed:

Names
Addresss
Dates of birth
Email addresses
Telephone numbers
TalkTalk account information
Credit card details and/or bank details

We are continuing to work with leading cyber crime specialists and the Metropolitan Police to establish exactly what happened and the extent of any information accessed.


We would like to reassure you that we take any threat to the security of our customers’ data very seriously. We constantly review and update our systems to make sure they are as secure as possible and we’re taking all the necessary steps to understand this incident and to protect as best we can against similar attacks in future. Unfortunately cyber criminals are becoming increasingly sophisticated and attacks against companies which do business online are becoming more frequent.
What we are doing

We are contacting all our customers straight away to let them know what has happened and we will keep you up to date as we learn more
We have taken all necessary measures to secure our website following the attack
Together with cybercrime experts, the security services and the police, we’re continuing to complete a thorough investigation
We’ve contacted the major banks, and they will be monitoring for any suspicious activity on our customers’ accounts
We have contacted the Information Commissioner’s Office

What you can do

Keep an eye on your accounts over the next few months. If you see anything unusual, please contact your bank and Action Fraud as soon as possible. Action Fraud is the UK’s national fraud and internet crime reporting centre, and they can be reached on 0300 123 2040 or via [You must be registered and logged in to see this link.]
If you are contacted by anyone asking you for personal data or passwords (such as for your bank account), please take all steps to check the true identity of the organisation.
Check your credit report with the three main credit agencies: Call Credit, Experian and Equifax

I reckon all these attacks originate in India and the police should start questioning some existing workers and disgruntled ex-workers.I myself had had more than 100 calls from Indians in the last year purporting to be from Talktalk's technical department.The point is the details stolen in the previous two hacks stayed in India.Talktalk needs to get out of India and fast .Lots of people needing jobs in Redcar,Scunthorpe and Strathclyde.Talktalk now needs to start to do the right thing to win back some credibility. The problem is that even if you store items in the database in encrypted form, at some point it has to be decrypted in order to display it to the user. This means that encryption is only effective if the attack occurs at the database level within the software stack. Obviously passwords don't need to be displayed ever, only verified, so one-way hashing can be used instead.

Roadworker wrote:

I reckon all these attacks originate in India and the police should start questioning some existing workers and disgruntled ex-workers.I myself had had more than 100 calls from Indians in the last year purporting to be from Talktalk's technical department.The point is the details stolen in the previous two hacks stayed in India.Talktalk needs to get out of India and fast .Lots of people needing jobs in Redcar,Scunthorpe and Strathclyde.Talktalk now needs to start to do the right thing to win back some credibility. The problem is that even if you store items in the database in encrypted form, at some point it has to be decrypted in order to display it to the user. This means that encryption is only effective if the attack occurs at the database level within the software stack. Obviously passwords don't need to be displayed ever, only verified, so one-way hashing can be used instead.

While we all agree that nothing can be 100% secure, Talktalk do seem to have fallen short of the industry standard (whatever that is) and they will be reaping the consequences for a long time to come, regardless of how well they close the stable door now the horses have bolted.