Thoughts on the TalkTalk breach

With the recent TalkTalk security breach impacting potentially 4 million UK customers my phone was ringing off the hook from late on Thursday 22nd October. Regularly when a big cyber security story hits the front pages I get asked by the media for expert opinion given my role at Queen’s University Belfast’s Centre for Secure Information Technologies (CSIT) – the UK’s Innovation & Knowledge Centre (IKC) and lead academic research centre for cyber security.

As with all stories of this nature I pull together some media briefing in advance of going into the studio. Here is some of that which consumers and businesses might find useful:

Top five customer tips following the TalkTalk security breach are as follows:

  1. Whilst you may not be able to change your TalkTalk Account password just yet, there will be many customers who will have used the same password across multiple online services. You should change those right now. Note – this won’t protect bank account/credit card details already stolen.
  2. TalkTalk have said that “there is a chance” that customer Credit Card and Bank Account details have been compromised. All TalkTalk customers present – and past – should keep a close eye on those accounts for the coming weeks and months and report any suspicious activity to their bank or card issuer immediately – no matter how small. If the details get resold, as they are likely to, the criminals may carry out small transactions first to ensure the account details are legitimate before initiating larger money transfers or purchases.
  3. Enable multi-factor authentication, or 2-Step verification, on online services were available. Online services such as Google Mail offer this. For example, when logging in a code will be sent to your phone via text, voice call, or our mobile app as an additional login step. Or, if you have a Security Key, you can insert it into your computer’s USB port to complete authentication.
  4. Never disclose your username, password, bank account, or credit card details to anyone who phones or emails you unsolicited. Ever.
  5. Be particularly careful clicking on links in e-mails or opening e-mail attachments received from people you don’t know. Even when the emails look legitimate, ensure the senders email address and web links are to genuine sites. Fraudsters can easily register domain names that look very similar to legitimate ones. For example looks like – swapping the l for an i

Top five business tips for companies who trade on-line:

  1. Always ensure that customer records including passwords, credit card details and bank account numbers are stored securely using modern hashing algorithms, ideally with salting, and are encrypted. This way if the databases are stolen – the data is practically worthless.
  2. Enable multi-factor authentication on systems
  3. Companies who are only now considering cyber security should sign up for the Cyber Essentials scheme. Cyber Essentials is a government-backed, industry supported scheme to help organisations protect themselves against common cyber attacks.
  4. Work closely with other organisations to share threat and attack intelligence and identify common patterns. Sign up to the Cyber-security Information Sharing Partnership (CiSP), part of CERT-UK, a joint industry government initiative to share cyber threat and vulnerability information in order to increase overall situational awareness of the cyber threat and therefore reduce the impact on UK business.
  5. If you haven’t got cyber security capability in-house then seek help. If you outsource your IT or web development make sure your suppliers are taking it seriously – get a third party company to audit them if necessary. Ultimately if your systems get hacked your customers will blame you.

Want to find out how you can secure systems and develop the next generation of cyber security technologies?

Hacking Handbook
Hacking Handbook

The featured image I have used for this post purposely features The Web Application Hackers Handbook for a reason. If the reports about this hack are correct, and I don’t wish to speculate until further hard facts come out, then a textbook SQL injection attack may have been used to gain access to customer data. Basic security housekeeping should have prevented this.

If you are interested in securing systems or researching new advanced cyber security technologies as a career we are actively recruiting new Cyber Security PhD students for the CSIT Centre for Doctoral Training (CDT) as well as full-time and part-time masters students for the industry informed CSIT MSc in Cyber Security at Queen’s University Belfast.

I have provided expert commentary on local and national media including:

There is still a long tail of media requests coming in as the story matures and more facts come out. If you need to get in touch with me my contact details are on the Centre for Secure Information Technologies website here.