Talk Talk (2015)

In October 2015, the British company TalkTalk was attacked through a SQL Injection vulnerability on several legacy webpages inherited from its acquisition of Tiscali. Using tools like SQLMap, the attackers identified vulnerabilities in these outdated pages and successfully accessed the "Tiscali Master" database, where they obtained customers' personal and financial data. In total, 156,959 accounts were compromised, including 15,656 bank account details and partial information from 28,000 credit and debit cards. The attack occurred due to a lack of basic security measures, insufficient system monitoring, and the non-encryption of sensitive data, which made entry significantly easy for the hackers. Investigations by authorities revealed that several individuals, including Daniel Kelley, had exploited this vulnerability and were subsequently convicted for their roles. The consequences of the attack were substantial: Customer Loss: TalkTalk lost thousands of customers. Financial Impact: The company suffered financial damages of approximately £77 million. Regulatory Fines: It was fined £400,000 by authorities for poor security practices. This incident clearly demonstrated that vulnerabilities in legacy systems and the failure to update them can lead to serious breaches, proving that SQL Injection remains one of the most dangerous threats to internet security.