Security Fail Allowed TalkTalk Customer to See Different Person’s Account UPDATE

One of TalkTalk’s UK broadband ISP customers, who asked to remain anonymous, has criticised the provider for being “staggeringly uninterested” after he reported a security flaw, which persisted for the best part of a week and enabled him to see the private personal account details of a different subscriber.

The customer had only recently joined the provider, but upon logging in to TalkTalk’s online account section on 5th March 2021 he was shocked to find that a different customer’s account details were being displayed. “This seems like a major breach of security regulations and something TalkTalk urgently must fix, I’ve contacted them, and they don’t seem very concerned,” he said.

According to the customer, he raised the “totally unacceptable” issue with TalkTalk’s customer care team on Twitter, but they just kept “repeating that I will be able to see my details when the account is activated, which rather misses the point, I think. I have repeated this a few times to them, but they keep saying the same thing.” The matter has also been raised with the Information Commissioner’s Office (ICO).

We’ve seen issues like this crop up with other providers from time to time too, and they’re often a symptom of isolated database errors. “As of this morning [9th March], I can still login and see this other person’s details. It’s a bit odd though as, on login, the page reloads several times, so it does seem like something is technically wrong,” added the customer.

ISPreview.co.uk raised the issue with TalkTalk and was promptly told that it was being investigated as a “matter of urgency and high priority.” After a couple of days the ISP was able to confirm that there had been an anomaly with one customer’s account (albeit affecting private data for two customers), but they added that it was a one-off error and has now been resolved. Sadly, it took an intervention from us before this happened.

The ISP made clear that there was no external penetration of their systems (hacking), nor any insider threat or intrusion, and the customer’s details were not stolen (we should add that no financial details were ever exposed).

A TalkTalk Spokesperson said:

“We have investigated the incident and identified a one-off technical error that led to a limited amount of one customer’s data being visible to the customer ISP Review contacted us about. This issue has now been fully resolved. We are in contact with and have apologised directly to the customer concerned.”

We queried how customers should go about the business of reporting future security issues to the provider and were advised that they should use TalkTalk’s regular customer channels (telephone, email, live chat and Twitter), even though that didn’t work too well this time around. TalkTalk added that keeping their customers’ data secure was a top priority, and they would always expedite the handling of such enquiries.

UPDATE 29th March 2021

We’ve been in contact with the TalkTalk customer who had their account exposed, and he claims to have been contacted by 11 of the provider’s other customers about the issue, which suggests that the breach was wider than the ISP indicated. The customer concerned is now considering legal action.