Talk Talk Cyber Hack

AndyPix · 6 November 2015 at 12:25PM

50Twuncle wrote: »

and whether anyone can withdraw any funds with these details ?

No - they cant - account numbers and sort code are used to put money IN an account ..
They could theoretically set up a direct debit using them - as famously happened to Jeremy Clarkson ..

50Twuncle wrote: »

Does anyone know of anyone who has actually lost any money through this hack ?

No body lost money through this hack.

The hack gave the attackers enough information that they could reasonably call up a talktalk customer and pretend to be talktalk ..

It is through this vector that people lost money, it got socially engineered (scammed) out of them.

Andy

strangeotron · 6 November 2015 at 12:53PM

AndyPix wrote: »

Its ok - If this is keeping you awake at night you can simply cancel the card that talktalk had the details for ..
Call your bank now and cancel it

Then you definitely do have nothing to worry about

It's not my account, as I made clear in the very first post.

A flippant attitude to this issue is uncalled for and is the sort of attitude that's got us here.

strangeotron · 6 November 2015 at 12:54PM

AndyPix wrote: »

No - they cant - account numbers and sort code are used to put money IN an account ..
They could theoretically set up a direct debit using them - as famously happened to Jeremy Clarkson ..

No body lost money through this hack.

The hack gave the attackers enough information that they could reasonably call up a talktalk customer and pretend to be talktalk ..

It is through this vector that people lost money, it got socially engineered (scammed) out of them.

Andy

Enabled by TT's disregard for the security of their customers.

That alone is bad enough.

dannyrst · 6 November 2015 at 12:56PM

Can I make it clear they used SQL injection to attack the database hosting the website. The only information they can access from this is the data that is stored on the website when you go into "My Account". No company would dream of storing sensitive information in that database, given that it is customer facing.

Full credit card details/bank details are stored in a database that has much more security and much less access.

AndyPix · 6 November 2015 at 12:59PM

strangeotron wrote: »

It's not my account, as I made clear in the very first post.

A flippant attitude to this issue is uncalled for and is the sort of attitude that's got us here.

Ok look - I have been trying to help you with actual positive steps you can take to mitigate this data loss.
I have been polite and precise.

I have not been flippant one little bit but have offered practical solutions to your concerns.

Facts : Partial credit card details were stolen - you believe this may not be the full truth .
Solution : Cancel your (or the persons you were posting about - jeez) credit card.

Result : No more problem.

Facts : The data stolen would empower a potential fraudster to be able to imitate talktalk in a call to you (or whoever)
Solution : Decline any call from TalkTalk, and call them back 30 mins later, on a number that you know is genuine, to see if they really wanted to speak to you.

Do you have any more concerns I can help with ?
You seem to want this to be worse than it is