In October 2015, attackers used SQL injection vulnerabilities in three TalkTalk webpages to reach the “Tiscali Master” database, part of legacy infrastructure inherited through TalkTalk’s 2009 purchase of Tiscali UK for £236 million. The Information Commissioner’s Office later found that TalkTalk was unaware some Tiscali pages remained publicly accessible. On 6 November 2015, TalkTalk said 156,959 customer accounts had been accessed, including 15,656 bank-account and sort-code records and partial information from 28,000 credit and debit cards. The company said the card data was obscured and that it had not been legally required to encrypt the stolen information.
The incident exposed failures in asset inventory, vulnerability management, and basic access security rather than an unavoidable technical attack. TalkTalk estimated direct and indirect costs at about £77 million and lost tens of thousands of broadband customers. On 5 October 2016, the ICO fined the company £400,000—then its largest penalty—after Commissioner Elizabeth Denham said hackers had penetrated the systems with ease because basic safeguards were absent. Five people were arrested; several were later convicted of hacking and related offenses, including Daniel Kelley, sentenced to four years’ detention in 2019. Customer litigation continued in the High Court from 2020, although the misuse-of-private-information claim was struck out in May 2022.
