TalkTalk Hacking

colsten

masonic wrote: »

Yes, card details were amongst the things reported to have been compromised, although I believe organisations are not supposed to store the cv number.

The 24/10/2015 3:30pm update from Talk Talk states that "We now expect the amount of financial information that may have been accessed to be materially lower than initially believed and would on its own not enable a criminal to take money from your account"
http://help2.talktalk.co.uk/oct22incident

Although you may argue that you don't believe anything Talk Talk are now saying. In which case, you should already have asked your bank to cancel your card - did you do that, RADDERS?

Westie983

colsten wrote: »

Although you may argue that you don't believe anything Talk Talk are now saying. In which case, you should already have asked your bank to cancel your card - did you do that, RADDERS?

Unless you change your bank account the detail TalkTalk have are your sort code and A/c number which wont change if you cancel the card, the PAN number and expiry date change.

masonic

Westie983 wrote: »

Unless you change your bank account the detail TalkTalk have are your sort code and A/c number which wont change if you cancel the card, the PAN number and expiry date change.

Sort code and account number being exposed is much less of a problem than exposure of the card details, which TalkTalk also have if radders paid upfront for line rental. Of course, if the card number was incomplete, more work would need to be done to identify the missing digits.

masonic

Malcnascar wrote: »

Perhaps it's time I admitted to my self that I need some help with my passwords. I know a bit about password managers but have resisted looking in detail at what they can do, how they work and would they work for me and finally would a password managers leave me at greater risk to the so called hackers.

If you are currently in a position where you are using weak passwords, or reusing the same password across lots of different sites, then a password manager would almost certainly offer a net benefit. In this case it doesn't seem that passwords were compromised, but if every site you visit has a unique password it will limit the fallout of data breaches like this considerably. Password managers will also autogenerate very strong passwords for you. Two options to consider would be Lastpass and Keepass, both of which are highly regarded. Lastpass stores an encrypted database of your passwords online, allowing synchronisation, but which you might not like for security reasons, whereas Keepass can be used with just a local password store.

One other thing that is quite important is to enable two factor authentication on your primary email account. Many compromises involve the hacker gaining access to the email of a victim after a breach at some other site. If your email provider doesn't support two factor, change provider.

GingerBob_3

masonic wrote: »

Yes, card details were amongst the things reported to have been compromised, although I believe organisations are not supposed to store the cv number.

But lots of them do - Amazon, for example.

masonic

GingerBob wrote: »

But lots of them do - Amazon, for example.

Are you sure about Amazon? They only ask for card number, name, expiration date and billing address when you add a new one. I'm not sure I've ever provided them with CVV2.

TadleyBaggie

masonic wrote: »

Are you sure about Amazon? They only ask for card number, name, expiration date and billing address when you add a new one. I'm not sure I've ever provided them with CVV2.

You are correct, when I added a new card recently I was not asked for the CVV2 number.

Goldiegirl

I think it comes down to who you want to believe


The media or Talk Talk.


I know I don't believe half or what I read in the media, so I come down in favour of believing Talk Talk. (I speak as a Talk Talk customer).


Talk Talk had no reason to lie about anything that they said - they came out in the open and said that there'd been a data breach - and knew they'd get a hell of a lot of adverse publicity.


Whereas the media have played on people's ignorance and fear and have every reason to manipulate and twist the facts to improve their ratings and sales. It seems they have been successful in whipping a portion of the British public into a frenzy of paranoia and indignation.


I can't say I'm delighted that a Russian Islamist (or whoever is responsible) may have my sorting code and account number.


But, I feel it is unlikely that he or she is going to trawl through 4 million peoples details to set up a direct debit on my account.


And just in case he does, I'll be keeping an eye on my account for new direct debits that have been set up. If, on the off chance, he sets up a direct debit..... I'd cancel it straight away.


If I forgot to look, and money was taken.... I'd be protected under the Direct Debit guarantee.


People really need to calm themselves down and look at things rationally. Be vigilant and check your financial affairs daily. Be very wary of phishing attempts.


Also, don't believe everything you read in the papers, particularly the Mail on Sunday!

GingerBob_3

masonic wrote: »

Are you sure about Amazon? They only ask for card number, name, expiration date and billing address when you add a new one. I'm not sure I've ever provided them with CVV2.

You could be right. However, a couple of days ago I renewed card details with Books Etc, and they did ask for the CVV. Maybe this is just to validate the card and they then ask for it when you order - I can't remember.


If Amazon don't ever request this info, either when signing up or when ordering, one must ask what use this code is - given that Amazon operate a "OneClick" ordering facility.

Futuristic

Talktalk confirmed full credit card details were not stored in their database as such if you pay via card you will be safe, you now need to ignore any calls pretending to be talk talk to get your data or send money to some scammers

Your bank details if you pay via direct debit could be used to set up direct debits on another site to take money from your account, charities etc don't really have fail proof mechanism as sites just ask for bank account details such as name, acc number and sort code

All end users can do is monitor their accounts as they should be doing regularly anyways