A 15-year-old boy has been arrested in Northern Ireland in connection with the cyber-attack on TalkTalk’s website.
The arrest is the first major development since the phone and broadband provider said last week it had been hacked, prompting warnings from the company that the bank details and personal information of its four million customers may have been accessed.
The boy was arrested in County Antrim at about 4.20pm on Monday by officers from the Police Service of Northern Ireland (PSNI), working with detectives from the Metropolitan police’s cybercrime unit (MPCCU).
The teenager was arrested on suspicion of offences under the Computer Misuse Act, police said. He was taken into custody at a County Antrim police station where he will be interviewed. A search of the address is under way and enquiries continue, police said.
A statement from TalkTalk said: “We know this has been a worrying time for customers and we are grateful for the swift response and hard work of the police. We will continue to assist with the ongoing investigation.
“In the meantime, we advise customers to visit http://talktalk.co.uk/secure for updates and information regarding this incident.”
Earlier on Monday it was announced that TalkTalk executives are to be summoned before MPs to explain how hackers were able to steal customer bank details as the company continues to try to limit the damage of last week’s cyber-attack.
On Monday the culture minister, Ed Vaizey, told the House of Commons that an inquiry into the TalkTalk hack will be launched by Jesse Norman, chair of the culture, media and sport select committee.
Shares in the embattled broadband and pay-TV firm fell 12% on Monday as city traders came to terms with the potential fallout of the hacking episode, the third possible data breach in 10 months. It has also emerged that the company could face claims amounting to millions of pounds from fraud victims who lose out as a result of the attack. The company has lost around £360m in value since it revealed details of the attack last Thursday.
TalkTalk said on Saturday that the amount of information was “materially lower” than first feared and insisted that it would be impossible for customers to lose any money solely as a result of the cyber-attack.
As investigations by both the Metropolitan police and the Information Commissioner’s Office (ICO) continue, the focus is turning to whether the company had properly protected itself, and whether sufficient fines are in place for data breaches.
The company chief executive, Dido Harding, insisted in the wake of the hack that the company’s cybersecurity was “head and shoulders” better than its competitors.
Security experts have been queuing up to claim that the TalkTalk attack was nothing out of the ordinary, and to point out the company’s failings.
One, Adrian Culley, a former Metropolitan police detective and now a security consultant, has likened it to the Great Train robbery and said the potentially liability for TalkTalk could be “huge”.
Announcing the inquiry, Vaizey described the hack as “very serious”, although he said any compensation for customers would be a matter for the information commissioner.
An ICO spokesperson said: “Our investigations into previous incidents are ongoing, and it wouldn’t be appropriate to presume a company had breached the Data Protection Act until our enquiries are complete. But what is clear is that organisations do need to make sure they have the appropriate level of security in place to protect the customer information they hold. If they don’t, we will act.”
Vaizey said the ICO can already levy “significant fines” but told MPs he was “open to suggestions” about how the situation could be “improved”.
TalkTalk is facing a maximum fine of £500,000 despite its annual turnover of £1.8bn a year.
The consumer group Which? called on the company to release affected customers without imposing early termination charges.
Which? executive director, Richard Lloyd, said: “Nobody should lose out as a result of this data breach, so TalkTalk should also look at what more it needs to do for its customers, including appropriate compensation for those affected. It’s important people are treated fairly so we expect that any affected TalkTalk customers who want to leave their contract should be able to do so without penalty.”
Exit penalties have to be paid by the customers if they opt to leave mid-contract, and can cost up to £300 in the telecoms sector.
TalkTalk said it would only let customers leave without penalty in the “unlikely event that money is stolen from a customer’s bank account as a direct result of the cyber-attack”.
The telecoms regulator Ofcom said on Monday it was “extremely concerned about the data breach and any potential effects” on customers.
“Until all of the facts have been established it is too early to say whether TalkTalk customers would have the right to terminate their contract,” said a spokeswoman.
Following a data breach in November 2014, scammers have repeatedly called customers and pretended to be from TalkTalk, while quoting them their account numbers to gain their trust. Having warned them that their computer was under threat of virus, they have successfully taken over the customer’s computer and gone on to apply a sophisticated scam and emptied their bank account. Dozen of victims said this has happened to them, but there are thought to be many more victims. Until now TalkTalk has refused to compensate them because financial information was not leaked.