On October 5, 2016, the UK Information Commissioner’s Office (“ICO”) fined telecoms company TalkTalk a record £400,000 for failing to put in place appropriate data security measures and allowing a cyber-attacker to access TalkTalk customer data “with ease.”  The ICO highlighted several  technical and organizational deficiencies as justification for issuing its largest fine to-date.  Many of these failings are unlikely to be unique to TalkTalk; organizations across all sectors should take note.

Background

Between October 15 and 21, 2015, a cyber-attacker took advantage of technical weaknesses in three of TalkTalk’s webpages.  As is often the case with weaknesses in cyber defences, the relevant infrastructure had been inherited as part of a previous acquisition.

The attacker accessed the personal data of over 150,000 customers, including their names, addresses, dates of birth, phone numbers and email addresses.  The attacker also accessed bank account details and sort codes in over 15,000 cases.

The attack has been subject to widespread media and even led to a Parliamentary inquiry and report.  TalkTalk decided to go public early.  Its CEO, Baroness Dido Harding, appeared on major news outlets globally, including the BBC’s flagship evening program, to warn customers about the potential attack.  (This was a risky strategy: Baroness Harding initially suggested the attack may have impacted over 4,000,000 customers — this turned out to be a 95% over-estimation — and came under fire for not knowing whether the data had been encrypted.)

ICO findings

Following investigation by the ICO specialist technical team (chronology available here), the ICO was particularly critical of several factors that allowed for such an incident to occur.  In particular:

  • TalkTalk failed to properly scan the inherited infrastructure for possible threats.  TalkTalk was not aware that the infrastructure included webpages that were still available online at the time of the attack or that they enabled access to the underlying database from which the customer data was taken.
  • TalkTalk failed to remove the webpages or ensure that they were otherwise secure.
  • The version of the database software installed and operated by TalkTalk was outdated and no longer supported by the provider.
  • The database software was affected by a bug – for which a fix had been available for over three and a half years prior to the attack but had not been applied by TalkTalk – that allowed the attacker to bypass access restrictions that were in place on the database.
  • The attacker used a “common” technique known as SQL injection, that has been “well understood” for more than ten years, to access the data.  Known defenses exist to prevent such techniques but TalkTalk had not implemented them.
  • TalkTalk had previously suffered SQL injection attacks twice in the same year on July 17, 2015, and between September 2-3, 2015, that exploited the same vulnerability in the webpages but TalkTalk did not take any action due to a lack of monitoring of the webpages.
  • TalkTalk failed to take appropriate proactive monitoring activities to discover vulnerabilities.

In light of the above, the ICO was satisfied that TalkTalk “ought to have known” that the cyberattack would cause “substantial damage or substantial distress to the data subjects,” and that TalkTalk failed to take reasonable steps to ensure that appropriate technical and organizational measures were taken against unauthorized or unlawful processing of personal data.

The ICO highlighted some mitigating factors.  These included the criminal nature of the attack, TalkTalk’s cooperation in the ICO investigation, the substantial remedial action that the company took, and data subjects being notified and offered free credit monitoring.

Notwithstanding these mitigating factors, the ICO justified the record fine by both the seriousness of TalkTalk’s “deficiencies” and also the impact such deficiencies were likely to have on the data subjects.

Comment

The TalkTalk case — and the ICO’s increasing focus on private sector companies more generally — should serve as a warning to companies to put robust technical and organizational policies and procedures in place to check systems, keep them up-to-date, and prevent the unauthorized disclosure of personal data, especially when inheriting IT infrastructure when acquiring companies.

Of course, the costs of any breach and terrible PR are likely to act as more of an incentive to put in place the necessary policies and procedures than being issued with the ICO’s pre-GDPR fines; TalkTalk reported a £15 million trading impact, exceptional costs of £40-50 million, and are understood to have lost over 100,000 customers following the attack.

Photo of Mark Young Mark Young

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to…

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to incidents, including personal data breaches, IP and trade secret theft, ransomware, insider threats, and state-sponsored attacks.

Mark has been recognized in Chambers UK for several years as “a trusted adviser – practical, results-oriented and an expert in the field;” “fast, thorough and responsive;” “extremely pragmatic in advice on risk;” and having “great insight into the regulators.”

Drawing on over 15 years of experience advising global companies on a variety of tech regulatory matters, Mark specializes in:

  • Advising on potential exposure under GDPR and international data privacy laws in relation to innovative products and services that involve cutting-edge technology (e.g., AI, biometric data, Internet-enabled devices, etc.).
  • Providing practical guidance on novel uses of personal data, responding to individuals exercising rights, and data transfers, including advising on Binding Corporate Rules (BCRs) and compliance challenges following Brexit and Schrems II.
    Helping clients respond to investigations by data protection regulators in the UK, EU and globally, and advising on potential follow-on litigation risks.
  • GDPR and international data privacy compliance for life sciences companies in relation to:
    clinical trials and pharmacovigilance;

    • digital health products and services; and
    • marketing programs.
    • International conflict of law issues relating to white collar investigations and data privacy compliance.
  • Cybersecurity issues, including:
    • best practices to protect business-critical information and comply with national and sector-specific regulation;
      preparing for and responding to cyber-based attacks and internal threats to networks and information, including training for board members;
    • supervising technical investigations; advising on PR, engagement with law enforcement and government agencies, notification obligations and other legal risks; and representing clients before regulators around the world; and
    • advising on emerging regulations, including during the legislative process.
  • Advising clients on risks and potential liabilities in relation to corporate transactions, especially involving companies that process significant volumes of personal data (e.g., in the adtech, digital identity/anti-fraud, and social network sectors.)
  • Providing strategic advice and advocacy on a range of EU technology law reform issues including data privacy, cybersecurity, ecommerce, eID and trust services, and software-related proposals.
  • Representing clients in connection with references to the Court of Justice of the EU.