The UK Information Commissioner’s Office fined telecoms company TalkTalk £400,000 for security failings that allowed an attacker to access customer data in October 2015. It was the ICO’s largest fine at the time. The penalty was issued under the Data Protection Act 1998, before GDPR raised maximum fines.
What happened
- The attacker exploited SQL injection vulnerabilities in legacy web pages inherited from TalkTalk’s acquisition of Tiscali.
- Personal data of 156,959 customers was accessed, including bank account details and sort codes in 15,656 cases.
- The ICO said TalkTalk had failed to take basic steps, noting the database software was outdated and that the company had missed earlier warning signs.
- Information Commissioner Elizabeth Denham said cyber security was ‘not an IT issue, it is a boardroom issue’.
Why it mattered
The case became a UK reference point for board-level accountability and showed that regulators would penalise basic security failings. Several young people involved in the attack were later convicted of criminal offences.
Lessons for organisations
Organisations should maintain an inventory of web applications, remove or patch legacy systems, and run regular vulnerability testing. Cyber Essentials covers many of the basic controls the ICO criticised TalkTalk for lacking.
Source: The Register
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
