Two teenage boys have been arrested in relation to a “significant and sustained cyberattack” on the British telecom company TalkTalk.
Police arrested a 16-year old boy in London on Thursday following the arrest of a 15-year old boy in Northern Ireland on Monday.
TalkTalk was forced to shut down its website last week after warning that the cyber attack put private data of four million people “at risk”.
The company said the initial attack was a DDOS — a distributed denial of service attack. TalkTalk also said it received a ransom demand following the attack.
Both teenagers have been released on bail.
TalkTalk is one of Britain’s leading phone providers and has four million customers. It initially warned clients that their birth dates, addresses, credit card and bank details may have been stolen, and they may be targeted by phishing attacks.
But on Friday the company said the damage was less than expected. It said the hackers accessed less than 21,000 bank account numbers, less than 15,000 customer birth dates and less than 1.2 million customer email addresses, names and phone numbers.
The company also said hackers got hold of incomplete credit card details for 28,000 customers.
One TalkTalk customer told CNNMoney she was conned out of more than £8,000 ($12,300) after someone claiming to be a TalkTalk employee convinced her to hand over her bank account information.
Barbara Manley, 82, said the person knew her personal details and told her the company needed her bank information to process a refund.