TalkTalk has said it does not know how many of its 4 million customers have been affected by a “significant and sustained” cyber-attack which could have compromised credit card and bank details.
Dido Harding, the chief executive, apologised to customers for the third cyber-attack affecting the telecommunications firm in the past 12 months but said the breaches were “completely unrelated”.
Harding told ITV’s Good Morning Britain that TalkTalk moved as fast as possible after being alerted to the hack. “On Wednesday lunchtime, all we knew was that our website was running slowly and that we had the indications of a hacker trying to attack us,” she said. “I can’t even tell you today exactly how many customers have been affected. We have tried to come public as fast as we can once we have got a reasonable idea of what potential data has been lost.
“I really appreciate the frustration and the worry and the concern that this causes customers – I am a customer myself – and I am very sorry for that. We are rushing to try and get that information to our customers as fast as we possibly can.”
TalkTalk admitted in its website FAQs section that some of the data was not encrypted but said it believed the firm’s systems were as secure as they could be.
Harding said Wednesday’s attack on TalkTalk’s systems should be treated as a crime. “Whether it is the US government, Apple, a host of companies, cybercrime is something we all need to get better at defending ourselves against,” she said.
The Metropolitan police cybercrime unit has launched an investigation into the breach amid speculation that the attackers could be Islamic extremists or extortionists.
Adrian Culley, a former detective at Scotland Yard’s cybercrime unit, said the hack appeared to be the work of Islamic militants after a group claimed responsibility for the attack in the name of Allah.
He told BBC Radio 4’s Today programme: “It appears at face value to be Islamic cyberterrorism.”
The claim could not be verified, but Culley pointed out that a group calling themselves “TalkTalk Hackers” published what they claimed were a sample of dozens of email addresses and national security numbers as proof of the attack.
They posted the message on the site Pastebin, which is often used by hackers for publishing large amounts of information. The message used the rhetoric of Islamic militants to justify the hack. It said: “We will teach our children to use the web for Allah … your hands will be covered in blood … judgement day is soon.”
Culley said the attack was a matter of national security. He said: “By the very nature of who TalkTalk are, they are [a] communications service provider, they are also part of the UK’s critical national infrastructure, so this is a concern not just for the police but the security services.”
Scotland Yard said: “There have been no arrests and inquiries are ongoing. We are aware of speculation regarding alleged perpetrators. This investigation remains at an early stage. A full assessment of the alleged data theft is ongoing.”
TalkTalk said: “That investigation is ongoing, but unfortunately there is a chance that some of the following data has been compromised: names, addresses, date of birth, phone numbers, email addresses, TalkTalk account information, credit card details and/or bank details.
“We are continuing to work with leading cybercrime specialists and the Metropolitan police to establish exactly what happened and the extent of any information accessed.”
TalkTalk shares tumbled more than 10%, wiping almost £300m from its stock market value, as investors worried about the financial impact of the cyber-attack.
One security expert said the breach could destroy trust in the phone and broadband provider. Jason du Preez, the chief executive of the data privacy company Privitar, said: “These hacks are not just embarrassing to the organisations involved. They can have really serious financial and personal consequences for your users, destroying consumer trust and loyalty.”
TalkTalk’s approach was criticised by cybersecurity expert Peter Sommer, a visiting professor at De Montfort University’s cybersecurity unit, who told Today: “Good practice says you ought to encrypt your data. The problem for these companies is staging their investment. They are constantly acquiring new customers, they are providing new services, the customers themselves want more facilities.
“You can quite see a situation in which, for straightforward commercial reasons a company decides to delay a little bit putting in an upgrade, it then has difficulties with the upgrade, it doesn’t think about the changed security environment, hackers are using new techniques all the time, and that’s the decision they have to make. It looks as though they have made some rather unfortunate decisions.”
Sommer said it was “not impossible” Islamic cyberterrorists were behind the attack, but it was more likely to be an attempt to extort money from TalkTalk or gain access to customers’ personal information.
“It seems to me the suggestion that these are Islamic terrorists who are perpetrating it is unlikely, not impossible,” he said. “One has to look at what is probably the most likely outcome. One of them is an extortion attempt, since they have gone public I suspect that’s not going to work. The other one is just to get hold of the credit card information, get hold of the personal information.”
Customers criticised TalkTalk over the announcement on Twitter. Katie Jonas said she had been on hold to TalkTalk customer services for more than an hour. “I’m very concerned that my bank details may have been taken but didn’t want to have to change all bank details. It’s a lot of hassle doing so but now it looks like I will have to after the disgusting customer service,” she said.
“I was angry enough being on hold that long but to then be cut off is terrible.”
In a letter to customers, TalkTalk’s managing director, Tristia Harrison, said the company took “any threat to the security of our customers’ data very seriously”.
The company said it had contacted major banks, which will monitor any suspicious activity from customers’ accounts, as well as the Information Commissioner’s Office. It is also organising free credit monitoring for a year for all customers.
Any customers who notice unusual activity on their accounts have been advised to contact their bank and Action Fraud, the UK’s national fraud and internet crime reporting centre. They have also been urged to change their TalkTalk account passwords and any other accounts that use the same passwords.
Source: https://www.theguardian.com
