TalkTalk warned its 4 million customers that hackers may have gained access to their personal information such as names, addresses, credit card details, dates of birth, phone numbers, email addresses, and account information from a recent cyberattack. This is the second security breach TalkTalk has experienced in the last 12 months. An investigation revealed that TalkTalk did not sufficiently encrypt all customer data and was vulnerable to a SQL injection attack, which allowed hackers to access their databases. Customers are advised to take steps like monitoring their credit reports and changing passwords to protect their information.

1. Sumit Rana
Jaimin Sanghvi

2.  TalkTalk warned its 4 million customers, that
attackers could have gained access to their
names, addresses, credit card and bank details,
dates of birth, phone numbers, email addresses
and TalkTalk account information.
 This is the second breach at the company in the
last 12 months.
 TalkTalk acknowledges that some of its data
wasn't protected by encryption

3.  Lack of strong encryption mechanism used by
TalkTalk.
 According to the reports, not all of the data was
encrypted, resulted into this hack.
 BBC technology expert Rory Cellan-Jones said
TalkTalk had apparently fallen victim to a simple
hacking trick known as an ”SQL injection”,
which it should have been able to protect against.

4.  TalkTalk stored customer information in SQL
databases.
 Reports suggest that TalkTalk was subjected to a
distributed denial-of-service attack that enabled the
attackers to utilise SQL injection techniques.
 SQL injection allows an attacker to feed commands
to a database via a poorly-designed website form or
input box.
 A DDoS attack can certainly put pressure on a
website, but it's highly likely that it was used as a
diversionary tactic while the attackers focused their
attention on TalkTalk's databases.

7.  Sign up to your free credit reporting service
 Change of passwords.
 Report anything suspicious on
http://www.actionfraud.police.uk
 Stay vigilant, TalkTalk will NEVER call
customers and ask for personal details or
passwords.

8.  TalkTalk doesn't yet know who perpetrated the
hack but has received a ransom demand from a
group purporting to be behind it.
 The Metropolitan Police Cyber Crime Unit is
investigating the attack but said that it has
made no arrests so far.

9.  The risk of identity theft and resulting fraud.
Identity theft can let hackers impersonate
people or companies, potentially using the
information they have to trick others into
handing over passwords and personal
information that could leave their accounts
exposed.

10.  http://help2.talktalk.co.uk/oct22incident
 http://www.cnet.com/news/isp-talktalk-hit-
by-significant-and-sustained-cyberattack-in-
uk/
 http://www.bbc.com/news/uk-34622754