2015 TalkTalk — 157K customers, SQL injection

2015 157.0K records affected

Data compromised

Names, addresses, DOB, bank details, card details

Technical writeup

SQL injection on three webpages. 15,656 bank details, 28K card details (incomplete). 1.2M emails/names/phones accessed. ICO fined £400K. Daniel Kelley jailed 4 years.

Root cause

SQL injection; unencrypted data

References

https://en.wikipedia.org/wiki/2015_TalkTalk_data_breach