Incident
incident:talktalk_october_2015_cyber_attack
Also: October 21, 2015 TalkTalk attack, TalkTalk 2015 breach, TalkTalk website attack
Attack against a legacy Tiscali web server and database that exposed TalkTalk customer records through SQL injection.
Attack against a legacy Tiscali web server and database that exposed TalkTalk customer records through SQL injection.
“What they found is that there was a SQL injection done on the website that was formerly part of the Tiscali network.”
“Two weeks later, TalkTalk announced exactly what had been taken.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | COMPROMISES | TalkTalk | Explicit | 4 |
| outgoing | INITIAL_ACCESS_VIA | Legacy Tiscali web server and database vulnerability | Explicit | 4 |
| outgoing | INVOLVES | SQL injection | Explicit | 4 |
| outgoing | INVOLVES | denial-of-service attack | Uncertain | 4 |
| outgoing | INVOLVES | ransom demand | Explicit | 4 |
| outgoing | INVOLVES | Bitcoin | Explicit | 4 |
| incoming | RELATED_TO | ICO investigation report on TalkTalk | Explicit | 4 |
TalkTalk October 2015 cyber-attack COMPROMISES TalkTalk
The attack compromised TalkTalk's website and exposed some customer data, although Harding later said the core systems were not attacked.
Explicit Confidence 98% · Harding EP 4 Details
“our website, our shop front, if you like, was attacked but our core systems weren’t”
TalkTalk October 2015 cyber-attack INITIAL_ACCESS_VIA Legacy Tiscali web server and database vulnerability
The attack gained access through an old, unpatched Tiscali web server and database vulnerability.
Explicit Confidence 99% · Jack Rhysider EP 4 Details
“that web server and database had not been patched for three and a half years”
TalkTalk October 2015 cyber-attack INVOLVES SQL injection
The attack involved SQL injection against a website formerly part of the Tiscali network.
Explicit Confidence 99% · Jack Rhysider EP 4 Details
“there was a SQL injection done on the website that was formerly part of the Tiscali network”
TalkTalk October 2015 cyber-attack INVOLVES denial-of-service attack
A denial-of-service attack was rumored and, if it occurred, may have served as a distraction rather than the main intrusion.
Uncertain Confidence 86% · Jack Rhysider EP 4 Details
“If there was a denial-of-service attack, it was more of a distraction than damaging.”
TalkTalk October 2015 cyber-attack INVOLVES ransom demand
The attack involved a ransom demand threatening to publish stolen data unless TalkTalk paid.
Explicit Confidence 99% · Jack Rhysider EP 4 Details
“The ransom threatened to publish the data that was stolen unless they pay $125,000”
TalkTalk October 2015 cyber-attack INVOLVES Bitcoin
The ransom demand requested payment in Bitcoin.
Explicit Confidence 99% · Jack Rhysider EP 4 Details
“unless they pay $125,000 in Bitcoin”
ICO investigation report on TalkTalk RELATED_TO TalkTalk October 2015 cyber-attack
The ICO investigation report addressed the TalkTalk attack, identifying the outdated database, the Legacy Tiscali pages, and SQL injection as part of the findings.
Explicit Confidence 99% · Jack Rhysider EP 4 Details
“The site says the database was out of date for three and a half years and the attack was through the Legacy Tiscali pages.”