On October 5, 2016, the UK Information Commissioner’s Office (“ICO”) fined telecoms company TalkTalk a record £400,000 for failing to put in place appropriate data security measures and allowing a cyber-attacker to access TalkTalk customer data “with ease.”  The ICO highlighted several  technical and organizational deficiencies as justification for issuing its largest fine to-date.  Many of these failings are unlikely to be unique to TalkTalk; organizations across all sectors should take note.

Background

Between October 15 and 21, 2015, a cyber-attacker took advantage of technical weaknesses in three of TalkTalk’s webpages.  As is often the case with weaknesses in cyber defences, the relevant infrastructure had been inherited as part of a previous acquisition.

The attacker accessed the personal data of over 150,000 customers, including their names, addresses, dates of birth, phone numbers and email addresses.  The attacker also accessed bank account details and sort codes in over 15,000 cases.

The attack has been subject to widespread media and even led to a Parliamentary inquiry and report.  TalkTalk decided to go public early.  Its CEO, Baroness Dido Harding, appeared on major news outlets globally, including the BBC’s flagship evening program, to warn customers about the potential attack.  (This was a risky strategy: Baroness Harding initially suggested the attack may have impacted over 4,000,000 customers — this turned out to be a 95% over-estimation — and came under fire for not knowing whether the data had been encrypted.)

ICO findings

Following investigation by the ICO specialist technical team (chronology available here), the ICO was particularly critical of several factors that allowed for such an incident to occur.  In particular:

• TalkTalk failed to properly scan the inherited infrastructure for possible threats.  TalkTalk was not aware that the infrastructure included webpages that were still available online at the time of the attack or that they enabled access to the underlying database from which the customer data was taken.

• TalkTalk failed to remove the webpages or ensure that they were otherwise secure.

• The version of the database software installed and operated by TalkTalk was outdated and no longer supported by the provider.

• The database software was affected by a bug – for which a fix had been available for over three and a half years prior to the attack but had not been applied by TalkTalk – that allowed the attacker to bypass access restrictions that were in place on the database.

• The attacker used a “common” technique known as SQL injection, that has been “well understood” for more than ten years, to access the data.  Known defenses exist to prevent such techniques but TalkTalk had not implemented them.

• TalkTalk had previously suffered SQL injection attacks twice in the same year on July 17, 2015, and between September 2-3, 2015, that exploited the same vulnerability in the webpages but TalkTalk did not take any action due to a lack of monitoring of the webpages.

• TalkTalk failed to take appropriate proactive monitoring activities to discover vulnerabilities.

In light of the above, the ICO was satisfied that TalkTalk “ought to have known” that the cyberattack would cause “substantial damage or substantial distress to the data subjects,” and that TalkTalk failed to take reasonable steps to ensure that appropriate technical and organizational measures were taken against unauthorized or unlawful processing of personal data.

The ICO highlighted some mitigating factors.  These included the criminal nature of the attack, TalkTalk’s cooperation in the ICO investigation, the substantial remedial action that the company took, and data subjects being notified and offered free credit monitoring.

Notwithstanding these mitigating factors, the ICO justified the record fine by both the seriousness of TalkTalk’s “deficiencies” and also the impact such deficiencies were likely to have on the data subjects.

Comment

The TalkTalk case — and the ICO’s increasing focus on private sector companies more generally — should serve as a warning to companies to put robust technical and organizational policies and procedures in place to check systems, keep them up-to-date, and prevent the unauthorized disclosure of personal data, especially when inheriting IT infrastructure when acquiring companies.

Of course, the costs of any breach and terrible PR are likely to act as more of an incentive to put in place the necessary policies and procedures than being issued with the ICO’s pre-GDPR fines; TalkTalk reported a £15 million trading impact, exceptional costs of £40-50 million, and are understood to have lost over 100,000 customers following the attack.