TalkTalk – What More Can We Say?

Last week TalkTalk was fined £400,000 by the Information Commissioner's Office (ICO) for breaching the Data Protection Act. This is the largest fine, to date, that the ICO has imposed – which emphasises the seriousness of the breach.

Back in October 2015, three webpages which TalkTalk controlled (due to acquiring Tiscali in 2009) were subject to a cyber attack. This cyber attack meant that the personal data of 156,959 customers was accessed; in 15,656 instances the attacker gained access to bank account details. Other types of data accessed included: names; addresses; dates of birth; phone numbers; e-mail addresses; and financial information.

TalkTalk became aware of the cyber attack and shut down its webpages. After which, they reported the breach to the ICO. Reporting the breach to the ICO is an obligation on service providers, such as TalkTalk, as set out in Regulation 5A(2) of the Privacy and Electronic Communications Regulations (PECR).