British broadband provider TalkTalk said a cyberattack on its website could have led to the theft of private data from more than 4m of its customers, in what would be one of the biggest such breaches of personal information in the country. The firm said late on Thursday (22 October) that investigations were ongoing, but there was a chance names, addresses, dates of birth, phone numbers, email addresses, TalkTalk account details, credit card details and/or bank details were compromised.

The attack is potentially one of the biggest and most damaging to hit a British company, and comes after several high profile cases in North America. The details of millions of customers of infidelity website Ashley Madison were leaked in August after a massive cyber assault, while Sony's film studios were hit in November 2014. CCLA's Chief Investment Officer James Bevan said Talk Talk's problems are "exceptionally serious".

"TalkTalk's problems in terms of the hacking into their systems is exceptionally serious for the company, both in terms of the comfort and credibility in management controlling these challenges, but also for the underlying customers and whether they really want to stay on the TalkTalk roster."

The attack is the third to hit TalkTalk this year, and experts said it would damage the reputation of the company, which competes with bigger rivals BT, Virgin Media and Sky. "There is a global problem associated with online businesses that data cannot be construed as genuinely safe at all times and it must now be the number one priority for global businesses with an online presence to protect their customers data and to protect their business integrity," said Bevan.

Shares in TalkTalk, which had fallen 7% since the group's websites went down on 21 October, fell another 8.5% on 23 October morning to a two-year low of 238 pence. "I certainly anticipate the company's making all the right noises but in a sense the proof of the pudding is in the eating, so we need to see tangible steps and real action."

Personal data, including names, addresses and phone numbers, were stolen from TalkTalk at the start of the year, and in August servers owned by Carphone Warehouse, the retailer that founded TalkTalk, was attacked, potentially affecting 480,000 TalkTalk mobile customers.

"I think the recovery in the TalkTalk share price will be slow and cautious in so far as we now need to see real evidence on two fronts − first that the company has solved the problem, and secondly that the customer numbers do not drop away," added Bevan.

A spokeswoman said the attack was the first time TalkTalk's own servers had been subjected to a sustained external attack.

More about TalkTalk
Cybercrime Sony LON:TALK