Peter A Clarke

The Talk Talk breach has had knock on effects, none good for TalkTalk Breach.  The regulator, the Information Commissioner’s Office, has become involved.  The ICO issued a release stating:

“The ICO is aware of this incident, which was reported to us on Thursday afternoon. We will be making enquiries and liaising with the Police.

“Any time personal data is lost there can be a risk of identity theft. There are measures you can take to guard against identity theft, for instance being vigilant around items on your credit card statements or checking your credit ratings. There are tips and information about identity theft available on our website.”

The ICO will no doubt be thorough and impartial. The problem for any organisation is that the regulator will go where the evidence takes it.  In the past the regulator has been advised of a breach only to find that there were even more eggregious practices which actually attracted the censure.  A regulator will look at all of an organisations processes, policies and programs relating to data storage and protection.  It is uncommon for an organisation to have only one area of non compliance.  Compliance tends to be a cultural and systemic issue.

It provides:

Regulators must be given significant new “US-style” powers to tackle the escalating problem of online fraud in the wake of the cyberattack that potentially potentially compromised the security of millions of TalkTalk customers, IT experts said. Their call came amid warnings that the security breach at the telecoms provider could cause problems for its victims that will last for years.

Some TalkTalk customers have complained that their bank accounts and credit cards have been targeted since Wednesday’s attack. But the TalkTalk chief executive, Dido Harding, insisted the data stolen in the cyberattack would not allow criminals to plunder customers’ bank accounts.

TalkTalk said complete credit card details are not stored in its system and that account passwords were not accessed. “We now expect the amount of financial information that may have been accessed to be materially lower than initially believed and would on its own not enable a criminal to take money from your account,” a spokesman added.

Earlier in the week, experts had warned the information seized – including names, addresses, date of birth, and email address of some of its four million customers – could still prove invaluable to criminals.

“With this level of information, fraudsters can create new bank accounts or take out loans under an actual person’s name, causing problems for fraud victims for years down the road,” said Ryan Wilk, director with NuData Security.

Experts predicted that the company could expect a grilling from the Information Commissioner’s Office which has issued guidance to customers who fear their personal details may have been accessed by criminals. It is likely to be asked about what steps it has taken to comply with stringent PCI/DSS regulations – the global standards set up by transaction companies such as MasterCard and Visa – that require companies to silo and isolate sensitive financial data.

Firms have to complete a PCI audit every year. How TalkTalk responded to the audits may be crucial as to whether it is fined by the ICO, suggested Dr Simon Moores, a former government technology adviser and chair of the International eCrime Congress, the industry body that brings together IT professionals working for governments and law enforcement agencies.

The ICO can impose penalties of up to £500,000 for companies that allow data protection breaches. But this is only a fraction of the amount that can be imposed in the US. Telecom giant AT&T was recently fined £17m over data breaches at its call centres in Mexico, Colombia and the Philippines.

“In light of the TalkTalk debacle, not only must the ICO review its powers and the levels of fine it can apply against companies shown to be remiss in looking after their customers, but the Financial Conduct Authority and parliament need to look more closely at this, given the extent of data breaches starting to appear,” Moores said.

Politicians on all sides signalled that they believed the law needed an overhaul.

Former home office minister Hazel Blears described the TalkTalk data breach as “a wake-up call” that should prompt a debate about whether further regulation was needed, suggesting cybercrime was “probably the biggest threat to our economy”.

Labour shadow cabinet minister Chi Onwurah has tabled parliamentary questions for the Department of Culture, Media and Sport asking how victims of data breaches can be informed and compensated.

“When you lose somebody’s data, you give the thieves a gateway into people’s lives,” Onwurah said. “I’m calling for a code of practice to encourage companies to take greater responsibility for data loss so that if an insurer loses your details and you get a hundred calls a week flogging PPI they have to compensate you.”
Advertisement

Some experts have called for the government to give a cabinet minister clear responsiblity for cybersecurity. At the moment various Whitehall departments have a role in countering the threat.

Joanna Sheilds, minister for internet safety and security, has a brief largely focused on protecting children online.

Questions remain about who was behind the attack. TalkTalk said it had been contacted by someone seeking a ransom payment, but the company was not sure if the message was genuine.

Harding said that “with the benefit of hindsight”, it was evident that TalkTalk had not done enough to protect itself. The latest breach is the third in a spate of cyber-attacks affecting the company in the last eight months. In August its mobile sales site was hit. In February its customers were warned about scammers who stole thousands of account numbers and names from the company’s computers.

In response to reports that it had been warned by experts about its security, a spokesman for the firm said: “New techniques for attack develop all the time, so TalkTalk constantly updates and reviews our systems to try to stay one step ahead of cybercriminals. Since the previous attacks, we are working with world leading cybersecurity experts and investing a lot in making sure our system is as secure as possible. Unfortunately, no system is ever totally invincible.”

The company’s accounts, published in June, reveal that a Head of Security was appointed “to establish and oversee the new Security Operations Centre, the activities of which have been outsourced to cyber security experts BAe systems.”

But, despite its efforts, Moores said searching questions would be asked about the company and its management.

Moores said: “Everything we have seen suggests that Talk Talk historically may have failed to take reasonable steps and that the CEO appears completely out of touch with the risks that are widely described. For that at least, she will have to answer to both her board and her customers.”

TalkTalk has made a very considerable in providing regular updates, Website attack affecting our customers, trying to give a clearer idea of what had happened.  It is quite a sophisticated and impressive approach.  Much better than the bland and factless statements that many organisations provide when suffering a data breach.
The updates state:

What should I do about it?