TalkTalk Reports Breach, up to 4 Million Unencrypted Records Stolen

UK-based ISP TalkTalk announced on October 22 that a recent attack on its website that gave hackers access to millions of customer records. The data compromised in the breach may have included names, birth dates, addresses, phone numbers, email addresses, TalkTalk account information, credit card details, and bank details.

Millions of users were notified by TalkTalk, claiming that the company has “taken all necessary measures” to keep the website secure. They are also working with banks to monitor its users’ accounts. They also mentioned offering a year’s free credit monitoring for all affected customers.

TalkTalk remains quiet on the issue of which user data has been encrypted and which aren’t, but did say that "not all of the data was encrypted." The company could be facing penalties if they neglected to encrypt its users’ credit data.

Encryption is a process that can be used to provide an additional layer of protection for data sources. In a sense, if the data stolen during the breach was encrypted, the contents would remain safe and inaccessible to cybercriminals.

[Read: Encryption 101: What It Is, How It Works, and Why We Need It]

This isn't the first time that they've been attacked. TalkTalk also reported a major breach back in late February, where attackers were reportedly able to steal sensitive customer information—including banking data—from TalkTalk. The attackers posed as customer service representatives then used the stolen information to trick users into divulging sensitive data.

In this latest incident, TalkTalk also received a ransom demand of £80,000 in Bitcoin from a group claiming to be behind the attack. According to this report, multiple hacker groups have since claimed responsibility for the attack, including an Islamist group based in Russia who released an online statement. The company's website has since been taken down to protect the data, and is still unavailable. The identity of the group responsible is still being investigated.

Users who have been contacted by TalkTalk, or any subscriber who believes that they could be affected by this data breach should take necessary precautions, including monitoring their financial accounts for any unauthorized movement. Cybercriminals may use the data against the users through several means.

[Read: Data Breaches 101: How They Happen, What Gets Stolen, and Where It All Goes]