UK telecommunications company TalkTalk has confirmed a data breach after a threat actor known as “b0nd” claimed responsibility on a cybercrime forum. The hacker asserted that they had stolen data from over 18.8 million TalkTalk subscribers, including sensitive information such as names, email addresses, IP addresses, phone numbers, and PINs. However, TalkTalk has disputed this claim, asserting that the reported number of affected customers is exaggerated and does not match the company’s actual subscriber count.
TalkTalk revealed that the breach occurred through a third-party platform, which the company did not name at the time. A spokesperson for the company, Liz Holloway, emphasized that the company was made aware of “unexpected access” to a third-party supplier’s system during regular security monitoring. Following the discovery, TalkTalk immediately took steps to contain the incident and is continuing to work with the supplier involved in the breach.
The company reassured customers that protective measures had been put in place.
Further investigation into the breach pointed to the Ascendon SaaS platform, which is used by TalkTalk. CSG, the company responsible for Ascendon, confirmed that the data in question had been stolen from their platform. However, CSG downplayed the incident, asserting that only one customer was affected and that their systems had not been compromised. The company also emphasized that no other data or technologies were exposed.
This incident marks another cyberattack on TalkTalk, which has a history of data breaches. In 2015, the company was hit by a major cyberattack that impacted four million subscribers, exposing the personal details of over 150,000 customers. Despite efforts to enhance security since then, this new breach highlights the ongoing challenges TalkTalk faces in safeguarding customer data, especially when relying on third-party suppliers.
Reference:
