British broadband provider TalkTalk revealed it has suffered an attack on its systems that may have led to the theft of personal data from its more than 4 million customers.
The data could include credit card and bank details, and if the theft is confirmed by a police investigation it would be one of Britain's biggest online security breaches.
The telco said it had received a ransom demand from an unidentified party claiming responsibility for the attack.
"We have been contacted by, I don't know whether it is an individual or a group, purporting to be the hacker," TalkTalk CEO Dido Harding told the BBC.
She said the demand for payment came by email into her corporate account, but she declined to give further details due to the ongoing police investigation.
Harding said a "very significant" amount of data was stolen, and she could not confirm whether customers' personal information was encrypted.
"I am confident a material number of our customers have been affected, which is why I am taking the precaution of warning all of our customers," she said.
Jens Monrad, security expert for FireEye, said samples of financial data which appeared to come from TalkTalk customers had been spotted for sale in cybercriminal forums on the so-called dark web.
A TalkTalk spokeswoman declined to comment, citing the police investigation.
The attack is potentially one of the most damaging to hit a British company, and follows dozens of high-profile cases targeting retailers and banks in North America.
TalkTalk said there was a chance names, addresses, dates of birth, phone numbers, email addresses, TalkTalk account information, credit card details and/or bank details had been accessed.
"Potentially this could affect all of our customers," Harding told the BBC.
The telco has hired defense company BAE Systems to investigate the attack.
A spokeswoman for BAE's Applied Intelligence division said the company's cyber-specialists were analysing "vast quantities" of data to help establish how the breach happened and what information was stolen.
TalkTalk later said the attack had occurred on its website, not its core systems, and said it did not store complete credit card details on the site.
"Any credit card details that may have been accessed had a series of numbers hidden and therefore are not usable for financial transactions eg 012345xxxxxx 6789," it said.
"We now expect the amount of financial information that may have been accessed to be materially lower than initially believed and would on its own not enable a criminal to take money from your account."
It is offering free credit reporting services to affected customers for a year from credit reference agency Noddle.
Third breach this year
The attack is the third data breach to hit TalkTalk this year, and experts said it would damage the reputation of the company, which competes with bigger rivals BT, Virgin Media and Sky in the broadband market.
"Their brand will be damaged and their customers will say it is the final straw," said computer security expert Graham Cluley.
Shares in TalkTalk, which had fallen 7 percent since its websites went down last Thursday, fell as much as 8.5 percent on Friday to a two-year low of £0.238 (A$0.51). They clawed back some of the losses to close down 4.4 percent at £0.257.
Monrad said hackers seeking to exploit the value of stolen customer data often publish small samples of the data in order to attract buyers in the underworld who will in turn try and exploit customer details for financial gain.
"Our field intelligence operation has found what appears to be a direct dump of various database information from TalkTalk," he said.
He said the samples FireEye had collected contained specific bank account and credit card information from what appeared to be TalkTalk customers.
Harding said the first sign the company was being targeted came on Thursday lunchtime, when its website was hit by what appeared to be a distributed denial of service (DDoS) attack - where a site is flooded by simultaneous request from multiple sources.
She said the company went public late on Friday when it had established that customer data had been compromised.
The Metropolitan Police said its cyber crime unit was investigating an alleged data theft from a telecommunications website, without giving details.
Personal data including names, addresses and phone numbers were stolen from TalkTalk at the start of the year, and in August servers owned by Carphone Warehouse, the retailer which founded TalkTalk, were attacked, potentially affecting 480,000 TalkTalk mobile customers.
.png&h=183&w=300&c=1&s=0)
.png&h=146&w=240&c=1&s=0)
