Two men have pleaded guilty to hacking into TalkTalk’s website in October 2015 and stealing thousands of customer records containing sensitive data.
Matthew Hanley, 22, of Devonshire Drive, Tamworth admitted to three offences under the Computer Misuse Act. The Metropolitan Police said that he confessed to breaching TalkTalk’s site, had obtained files that would enable the hacking of websites, and supplied files to assist other hackers by flagging up vulnerabilities in the budget telco’s systems.
Twenty-year-old Conner Douglas Allsopp of Ludgate, Tamworth ‘fessed up to “supplying an article for use in fraud and supplying an article intended for [use] in the commission of a [hacking] offence under the Computer Misuse Act,” the Met said.
Hanley, who was fingered as a suspect by Scotland Yard’s cyber crime officers early in their investigation, also pleaded guilty to supplying a spreadsheet listing TalkTalk customer details for use in fraud.
He was arrested on October 30, 2015 but following a raid at his home address when computers and devices were seized, cops discovered that data had been either wiped or encrypted.
Hanley was less careful online, however, and a search of his social media accounts proved fruitful to police. Scotland Yard said
Detectives discovered conversations where Hanley had been discussing his involvement and actions in hacking into TalkTalk’s website and also discussing how he had deleted incriminating data from his computers and encrypted his devices in order to cover his tracks.
The chat logs also revealed that having stolen the data from TalkTalk, Hanley then got Allsopp to try and sell the personal data of customers so that the pair could profit from it.
Allsopp was arrested in April 2016 and admitted—after police told him they had evidence from the chat logs with Hanley—that he had unsuccessfully tried to sell TalkTalk customer data. Allsopp also attempted to sell details of the eminently avoidable vulnerabilities that had been found on TalkTalk’s site.
The telco has since been fined £400,000 for what the Information Commissioner’s Office said was an avoidable security blunder, but instead “technical weaknesses” exposed the sensitive data of nearly 157,000 customers. It meant that malefactors could swipe subscriber information “with ease,” the watchdog said.
Data targeted by the hackers was from an underlying customer database acquired by TalkTalk when it scooped up Tiscali’s UK operations in 2009, the ICO discovered during its investigation. The miscreants attacked three vulnerable webpages using the SQL injection method, after TalkTalk had failed to spot that the software was affected by a bug, which could have been easily patched.
“Hanley thought that he was being smart and covering his tracks by wiping his hard drives and encrypting his data. But what our investigation shows is that no matter how hard criminals try to conceal their activity, they will leave some kind of trail behind,” said the Met’s fraud and cyber crime DCI Andy Gould.