TalkTalk reported on Friday that the personal details of only 156,959 customers were accessed in the recent data breach.
According to the British phone and broadband services provider, the bank account numbers of only 15,656 of these customers were accessed by the attackers. The company also revealed that the hackers accessed 28,000 credit and debit card numbers, but since the information was partially redacted it cannot be used to financial transactions.
“Our ongoing forensic analysis of the site confirms that the scale of the attack was much more limited than initially suspected, and we can confirm that only 4% of TalkTalk customers have any sensitive personal data at risk. However, we continue to advise customers to be vigilant, and to take all precautions possible to protect themselves from scam phone calls and emails,” TalkTalk said in its latest update on the extent of the breach.
The company says it has contacted all customers whose financial information has been compromised. Customers who had other types of information exposed will be contacted in the coming days.
In a previous update, the company estimated that the hackers had stolen the names, email addresses, and phone numbers of roughly 1.2 million customers. TalkTalk also previously stated that “less than” 15,000 dates of birth had also been accessed, but there is no mention of this type of information in the latest update.
In an updated FAQ posted on its website, the company told customers that while it overreacted in the initial assessment of the breach, it wanted to be honest and transparent and warn users of the potential risk.
Law enforcement authorities in the United Kingdom have already arrested four individuals believed to be linked to the TalkTalk breach. The suspects, all of whom have been released on bail, are a 16-year-old boy from west London, a 15-year-old boy in Northern Ireland, a 16-year-old boy in east England, and a 20-year-old man in central England.
The last suspect questioned by authorities, the one from the east England city of Norwich, might be a hacker who uses the online moniker “Glubz.” The hacker specializes in selling online accounts that have sought-after usernames, also known as “OG” accounts, Brian Krebs reported earlier this week.