Regulators must be given significant new “US-style” powers to tackle
the escalating problem of online fraud in the wake of the cyberattack
that potentially potentially compromised the security of millions of
TalkTalk customers, IT experts said. Their call came amid warnings that
the security breach at the telecoms provider could cause problems for
its victims that will last for years.
Some TalkTalk customers have complained that their bank accounts and credit cards have been targeted since Wednesday’s attack. But the TalkTalk chief executive, Dido Harding, insisted the data stolen in the cyberattack would not allow criminals to plunder customers’ bank accounts.
TalkTalk said complete credit card details are not stored in its system and that account passwords were not accessed. “We now expect the amount of financial information that may have been accessed to be materially lower than initially believed and would on its own not enable a criminal to take money from your account,” a spokesman added.
Earlier in the week, experts had warned the information seized – including names, addresses, date of birth, and email address of some of its four million customers – could still prove invaluable to criminals.
“With this level of information, fraudsters can create new bank accounts or take out loans under an actual person’s name, causing problems for fraud victims for years down the road,” said Ryan Wilk, director with NuData Security.
Experts predicted that the company could expect a grilling from the Information Commissioner’s Office which has issued guidance to customers who fear their personal details may have been accessed by criminals. It is likely to be asked about what steps it has taken to comply with stringent PCI/DSS regulations – the global standards set up by transaction companies such as MasterCard and Visa – that require companies to silo and isolate sensitive financial data.
Firms have to complete a PCI audit every year. How TalkTalk responded to the audits may be crucial as to whether it is fined by the ICO, suggested Dr Simon Moores, a former government technology adviser and chair of the International eCrime Congress, the industry body that brings together IT professionals working for governments and law enforcement agencies.
The ICO can impose penalties of up to £500,000 for companies that allow data protection breaches. But this is only a fraction of the amount that can be imposed in the US. Telecom giant AT&T was recently fined £17m over data breaches at its call centres in Mexico, Colombia and the Philippines.
“In light of the TalkTalk debacle, not only must the ICO review its powers and the levels of fine it can apply against companies shown to be remiss in looking after their customers, but the Financial Conduct Authority and parliament need to look more closely at this, given the extent of data breaches starting to appear,” Moores said.
Politicians on all sides signalled that they believed the law needed an overhaul.
Former home office minister Hazel Blears described the TalkTalk data breach as “a wake-up call” that should prompt a debate about whether further regulation was needed, suggesting cybercrime was “probably the biggest threat to our economy”.
Labour shadow cabinet minister Chi Onwurah has tabled parliamentary questions for the Department of Culture, Media and Sport asking how victims of data breaches can be informed and compensated.
“When you lose somebody’s data, you give the thieves a gateway into people’s lives,” Onwurah said. “I’m calling for a code of practice to encourage companies to take greater responsibility for data loss so that if an insurer loses your details and you get a hundred calls a week flogging PPI they have to compensate you.”
Some experts have called for the government to give a cabinet minister clear responsiblity for cybersecurity. At the moment various Whitehall departments have a role in countering the threat.
Joanna Sheilds, minister for internet safety and security, has a brief largely focused on protecting children online.
Questions remain about who was behind the attack. TalkTalk said it had been contacted by someone seeking a ransom payment, but the company was not sure if the message was genuine.
Harding said that “with the benefit of hindsight”, it was evident that TalkTalk had not done enough to protect itself. The latest breach is the third in a spate of cyber-attacks affecting the company in the last eight months. In August its mobile sales site was hit. In February its customers were warned about scammers who stole thousands of account numbers and names from the company’s computers.
In response to reports that it had been warned by experts about its security, a spokesman for the firm said: “New techniques for attack develop all the time, so TalkTalk constantly updates and reviews our systems to try to stay one step ahead of cybercriminals. Since the previous attacks, we are working with world leading cybersecurity experts and investing a lot in making sure our system is as secure as possible. Unfortunately, no system is ever totally invincible.”
The company’s accounts, published in June, reveal that a Head of Security was appointed “to establish and oversee the new Security Operations Centre, the activities of which have been outsourced to cyber security experts BAe systems.”
But, despite its efforts, Moores said searching questions would be asked about the company and its management.
Moores said: “Everything we have seen suggests that Talk Talk historically may have failed to take reasonable steps and that the CEO appears completely out of touch with the risks that are widely described. For that at least, she will have to answer to both her board and her customers.”
Some TalkTalk customers have complained that their bank accounts and credit cards have been targeted since Wednesday’s attack. But the TalkTalk chief executive, Dido Harding, insisted the data stolen in the cyberattack would not allow criminals to plunder customers’ bank accounts.
TalkTalk said complete credit card details are not stored in its system and that account passwords were not accessed. “We now expect the amount of financial information that may have been accessed to be materially lower than initially believed and would on its own not enable a criminal to take money from your account,” a spokesman added.
Earlier in the week, experts had warned the information seized – including names, addresses, date of birth, and email address of some of its four million customers – could still prove invaluable to criminals.
“With this level of information, fraudsters can create new bank accounts or take out loans under an actual person’s name, causing problems for fraud victims for years down the road,” said Ryan Wilk, director with NuData Security.
Experts predicted that the company could expect a grilling from the Information Commissioner’s Office which has issued guidance to customers who fear their personal details may have been accessed by criminals. It is likely to be asked about what steps it has taken to comply with stringent PCI/DSS regulations – the global standards set up by transaction companies such as MasterCard and Visa – that require companies to silo and isolate sensitive financial data.
Firms have to complete a PCI audit every year. How TalkTalk responded to the audits may be crucial as to whether it is fined by the ICO, suggested Dr Simon Moores, a former government technology adviser and chair of the International eCrime Congress, the industry body that brings together IT professionals working for governments and law enforcement agencies.
The ICO can impose penalties of up to £500,000 for companies that allow data protection breaches. But this is only a fraction of the amount that can be imposed in the US. Telecom giant AT&T was recently fined £17m over data breaches at its call centres in Mexico, Colombia and the Philippines.
“In light of the TalkTalk debacle, not only must the ICO review its powers and the levels of fine it can apply against companies shown to be remiss in looking after their customers, but the Financial Conduct Authority and parliament need to look more closely at this, given the extent of data breaches starting to appear,” Moores said.
Politicians on all sides signalled that they believed the law needed an overhaul.
Former home office minister Hazel Blears described the TalkTalk data breach as “a wake-up call” that should prompt a debate about whether further regulation was needed, suggesting cybercrime was “probably the biggest threat to our economy”.
Labour shadow cabinet minister Chi Onwurah has tabled parliamentary questions for the Department of Culture, Media and Sport asking how victims of data breaches can be informed and compensated.
“When you lose somebody’s data, you give the thieves a gateway into people’s lives,” Onwurah said. “I’m calling for a code of practice to encourage companies to take greater responsibility for data loss so that if an insurer loses your details and you get a hundred calls a week flogging PPI they have to compensate you.”
Some experts have called for the government to give a cabinet minister clear responsiblity for cybersecurity. At the moment various Whitehall departments have a role in countering the threat.
Joanna Sheilds, minister for internet safety and security, has a brief largely focused on protecting children online.
Questions remain about who was behind the attack. TalkTalk said it had been contacted by someone seeking a ransom payment, but the company was not sure if the message was genuine.
Harding said that “with the benefit of hindsight”, it was evident that TalkTalk had not done enough to protect itself. The latest breach is the third in a spate of cyber-attacks affecting the company in the last eight months. In August its mobile sales site was hit. In February its customers were warned about scammers who stole thousands of account numbers and names from the company’s computers.
In response to reports that it had been warned by experts about its security, a spokesman for the firm said: “New techniques for attack develop all the time, so TalkTalk constantly updates and reviews our systems to try to stay one step ahead of cybercriminals. Since the previous attacks, we are working with world leading cybersecurity experts and investing a lot in making sure our system is as secure as possible. Unfortunately, no system is ever totally invincible.”
The company’s accounts, published in June, reveal that a Head of Security was appointed “to establish and oversee the new Security Operations Centre, the activities of which have been outsourced to cyber security experts BAe systems.”
But, despite its efforts, Moores said searching questions would be asked about the company and its management.
Moores said: “Everything we have seen suggests that Talk Talk historically may have failed to take reasonable steps and that the CEO appears completely out of touch with the risks that are widely described. For that at least, she will have to answer to both her board and her customers.”
No comments:
Post a Comment