TalkTalk, 2015: a nineteen-year-old and a webpage nobody owned

In October 2015 the chief executive of TalkTalk went on national radio and was asked whether the stolen customer data had been encrypted. She said she did not know. That answer, more than the breach, is what the incident is remembered for in Britain, and the technical story underneath it is worse, because the way in had been sitting unattended on the company's own website for six years.

What happened

TalkTalk acquired Tiscali UK in 2009. Along with the customers came the infrastructure, including a set of webpages that continued to be served from TalkTalk's domain. Three of those pages contained a SQL injection vulnerability. The underlying database software was unsupported and had been for years. After the acquisition, nobody at TalkTalk had scanned, reviewed or apparently thought about those pages at all.

Between 15 and 21 October 2015, attackers found them, trivially, using automated scanning tools available to anyone, and used the injection flaw to read data out of the database behind them. The ICO later found that the vulnerability could have been fixed with a software update that had been available since 2012, and that TalkTalk had no process that would have found it.

The regulator also established that two earlier attacks on the same pages, in July and September 2015, had gone unnoticed.

The disclosure made it worse

TalkTalk announced the breach quickly, which was to its credit, and then described it in terms it could not support. Early statements raised the possibility that all four million customers were affected. Reports referred to a "significant and sustained cyberattack", language that implied a sophisticated adversary. The eventual attackers were teenagers using off-the-shelf tools against a fifteen-year-old class of vulnerability.

The confusion over encryption compounded it. Some fields were encrypted, some were not, and in the first days the company could not say clearly which. For customers deciding whether to change bank details, that distinction was the only thing that mattered, and they could not get it.

Then came the fraud calls. Criminals with a customer's name, address, TalkTalk account number and in some cases bank details could open a phone call with verification data no stranger should have. Several victims reported losing substantial sums to callers who had been able to prove, convincingly, that they were TalkTalk.

The timeline

1. 2009: TalkTalk acquires Tiscali UK, inheriting the webpages that will later be attacked.
2. 2012: A fix for the underlying database vulnerability becomes available and is not applied.
3. July and September 2015: Two earlier attacks exploit the same pages without being detected.
4. 15 – 21 October 2015: The main attack extracts customer data.
5. 22 October 2015: TalkTalk goes public, with figures that later prove much too high.
6. October – November 2015: Several arrests follow; customers report fraud calls using their stolen details.
7. 5 October 2016: The ICO fines TalkTalk £400,000, the largest penalty it had ever issued.
8. August 2017: A further £100,000 fine follows over call centre staff access to 21,000 customers' records.
9. 2019: Daniel Kelley is sentenced to four years.

What it changed

It became the case study for UK regulators and parliament. A Commons select committee ran an inquiry into the protection of personal data online off the back of it, and its recommendations, escalating fines, security as a board responsibility, clearer breach notification, fed directly into how GDPR was received in Britain two years later.

The £400,000 fine established a ceiling that was about to disappear. It was the maximum the ICO could then issue, and commentators noted repeatedly that under GDPR the same conduct could attract a penalty measured in percentage of turnover. That comparison did a great deal to get UK boards to take the incoming regulation seriously.

Asset inventory stopped being a paperwork exercise. TalkTalk lost 156,959 customers' data through pages it did not know it was serving. "What is on our public internet estate, and who owns each thing on it" became a first-order security question, and the external attack surface scanning industry grew out of exactly this problem.

The cost of the response dwarfed the fine. The £400,000 penalty is the number everyone remembers. TalkTalk's own reporting put the incident's cost at around £42 million and the company lost 101,000 customers in the following quarter. For a consumer business, the regulator is rarely the expensive part.

If you were affected