TalkTalk investigates data breach after hackers claim to have stolen customer data

British telecoms giant Talktalk has confirmed it is investigating a data breach after a hacker claimed to have stolen the personal information of millions of customers.

In a post on a popular cybercrime forum seen by TechCrunch, an individual using the alias “B0nd” claims to have stolen the personal data of more than 18.8 million current and former TalkTalk subscribers. Threat actors offer data for sale, which is said to include customer names, email addresses, IP addresses, phone numbers and user pins.

TalkTalk spokesperson Liz Holloway confirmed in a statement to TechCrunch that the company was investigating the data breach, but said the 18.8 million figure claimed by the hackers was “completely inaccurate and a very clear exaggeration.”

TechCrunch has learned that TalkTalk currently has about 2.4 million customers.

“As part of our ongoing concern about our customers' personal data, we have become aware of unintended access and misuse of one of our third-party vendor's systems,” Holloway told TechCrunch. “Our security incident response team is continuing to work with the vendor on this matter and immediate protective containment steps were taken.”

Holloway declined to name the third-party vendor, but screenshots shared by B0nd showed that the data was stolen from CSG's Ascendon platform Talktalk, which is used for subscription management.

In a statement sent to TechCrunch, CSG spokesperson Christine Østergaard said the company learned that “an external party gained unauthorized access to data from a single provider located on the CSG platform.” But, she added, the CSG had “no evidence”. Its systems were compromised, or CSG was the cause of the Talktalk breach.

TechCrunch has learned that the personal details of a small number of TalkTalk customers were stored in Ascendon. Holloway confirmed to TechCrunch that “no billing or financial information is stored on the system.”

TalkTalk was previously fined £400,000 after hackers stole the personal data of 157,000 customers, including some financial information. The UK's information commissioner said at the time that TalkTalk failed to implement “the most basic cyber security measures”, which allowed hackers to “easily penetrate its systems”.

Updated with comments from CSG.