UPDATE Teenage TalkTalk ISP Hacker Given Rehabilitation Order by Court

A little too lenient? The Norwich Youth Court has today handed down a Rehabilitation Order to a 17-year-old boy after he admitted to seven charges under the Computer Misuse Act 1990, two of which are in connection with last year’s cyber-attack on TalkTalk. They also took his iPhone away.

The attack (here), which enabled the hacker(s) to access personal data from 156,959 customers (names, addresses, dates of birth, phone numbers and email addresses) and financial data belonging to 15,656 others, also appeared to be followed by a rise in scams as fraudsters attempted to con the ISPs customers out of their money (this is also a more general problem for ISPs).

In the end TalkTalk was hit by a £400,000 fine as a result of the massive personal data breach (here) and they’ve spent the past year trying to recover from the incident. However we’ve recently started to see a number of people being formally charged with related offences and several court cases have begun (example).

Last month the 17-year-old boy mentioned in today’s case, who cannot be named for the usual legal reasons (no doubt related to his age), admitted to seven related charges under the Computer Misuse Act 1990 and said that he was “just showing off to my mates“. The boy has now been slapped with a Rehabilitation Order and had his iPhone taken away.

The BBC reports that chairman of the bench, Jean Bonnick, told him: “Your IT skills will always be there – just use them legally in the future.” At this point we must stress that the full details of the case are not yet known and others are arguably more responsible for the incident, thus we shall avoid passing too much judgement.

Apparently the boy had been using hacking tools against a number of different websites (e.g. Manchester University and Cambridge University Library), as well as exposing a vulnerability on TalkTalk’s site. Apparently the ISP’s website was “targeted more than 14,000 times” after the vulnerability was exposed.

UPDATE 4:45pm

Separately 19-year-old Daniel Kelley from South Wales, who was recently charged with 14 offences (including eight of blackmail, four for computer hacking and two for fraud), has now pleaded guilty to hacking TalkTalk and attempting to blackmail its CEO, Dido Harding, for 465 Bitcoin (worth around £285K).

Judge Paul Worsley told Kelley, who also pleaded guilty to a number of other offences, that he faced time in jail and the precise punishment would be set out on 6th March 2017. As an adult Kelley will face much stiffer punishment, despite only being a little older than the boy mentioned above.

A TalkTalk spokesman said:

“The Metropolitan Police and the CPS have worked hard to find those responsible for the cyber attack, and we are pleased that their investigations have led to two successful prosecutions.

We hope that this outcome will encourage other companies to inform their customers and the police quickly when they are attacked.”