TalkTalk has sent an email to customers, informing them that scammers are using stolen TalkTalk data - including account numbers, addresses, and phone numbers (but not payment information, or dates of birth) - to con people into handing over their bank details.
One victim told The Guardian he had been tricked out of £2,800 by a woman who claimed to be from TalkTalk's fraud team, who reassured him she was legitimate by quoting back his personal details and TalkTalk account number.
TalkTalk told the BBC the data theft was discovered when it began investigating a spike in complaints from customers about scam calls between October and December 2014. TalkTalk employed an external security company which found the company's internal systems had been hacked into by a third-party that also had access to its network.
A TalkTalk spokeswoman told The BBC the company could not put an exact figure on how many customers' data went astray, but said the number affected was in the "small thousands." That's just a small percentage of the 4 million customers it has currently.
TalkTalk provided the BBC with this statement: "We have now concluded a thorough investigation with an external security company, and we have become aware that some limited non-sensitive information may have been illegally accessed in violation of our security procedure."
The statement continues: "We are aware of a small, but nonetheless significant, number of customers who have been directly targeted by these criminals and we have been supporting them directly."
Customers affected by the hack attack or scam calls have been encouraged to call a dedicated helpline: 0800 083 2710. TalkTalk says customers who have been tricked into handing over their banking details should also contact their banks. The company has also posted advice on its help page.