TalkTalk website hit by cyber-attack

TalkTalk website hit by cyber-attack- BBC

Im on TTB but via a reseller. Do resellers pass on customer data to Talk Talk or am i safe?

Sorry, I wouldn't know, but people in TT forums might or someone can provide that info later. There is a statement on TT website:

http://help2.talktalk.co.uk/oct22incident

Pulse8 replied saying only basic info is passed over which is needed to get a line installed. So assume tel no and address?

I have just heard Dido Harding on R4. She was asked "Can you confirm that customer data was encrypted". She refused to answer that it had been. Make of that what you will.

There own statements admits not all was encrypted. Funny how they claim customer data security is at the upmost importance then dont encrypt some of it. So clearly its not is it?

Why dont all companies encrypt ALL customer data? Too many dont and there is no excuse these days not to

Wouldn't data encryption be more relevant in the case of physical hard drive theft? If this attack was using an exploit in TalkTalk control panel systems, which would need to decrypt the data in order to make use of it, then the encryption would be bypassed I would have thought.

Not sure in this case but there has been data theft where hackers stole a database with details stored in plain text. PSN for example to name just one

Should be law that data cannot be stored in plain text

If someone has managed to steal a database it usually means they would have no trouble finding decryption keys, i.e. you email address has to be stored in a way that can be decrypted to send you an email, or your address for posting out bills

There are ways to store passwords so that not even the website owner can get the actual password back, i.e. one way encryption. Though some of these methods can be broken given resources - hence why at this stage any discussion is going to be vague so not to give people who have acquired data any snippets of useful information.

In reply to a post by MHC:

I have just heard Dido Harding on R4. She was asked "Can you confirm that customer data was encrypted". She refused to answer that it had been. Make of that what you will.

And this despite having answered in the negative on their own website...with the addition of a beautiful example of obfuscation in answering a different question to the one posed.


""Was the data encrypted? If not, why not?"

Not all of the data was encrypted. We constantly review and update our systems to make sure they are as secure as possible. We�re working with the police and cyber security experts to understand what happened and protect as best we can against similar attacks in future."