TalkTalk chief received email demanding money from cyber attackers

The chief executive of TalkTalk has told the BBC that she received an email demanding a ransom from a group purporting to be behind the cyber-attack suffered by her company.

Dido Harding also said that she could not guarantee that all the customer data stolen was encrypted and admitted that, in hindsight, the company could have done more on keeping customer data secure.

The company would now be launching an internal inquiry, she said.

Ms Harding said that it appeared the criminals behind cyber-attacks now believed that not only is customer data valuable, but so is the ability of cyber attackers to bring down a company's digital infrastructure.

"It is hard for me to give you very much detail, but yes, we have been contacted by, I don't know whether it is an individual or a group, purporting to be the hacker," she told me.

'Dark web'

I asked her whether a payment had been demanded.

"It is a live criminal investigation," she said.

"All I can say is that I had personally received a contact from someone purporting - as I say I don't know whether they are or are not - to be the hacker looking for money.

"If you're a cyber-criminal, the days of stealing data and then selling it for cash in the dark web - they're not so profitable as they used to be.

"And I do think that you see more cyber criminals wanting to effectively make money by extorting the companies that hold that data, and there've been a number of incidents just this week."

Ms Harding has taken the decision that "going public" is the best route.

She said that TalkTalk could not have moved any more quickly to inform its customers, and that the company was still unclear on the full extent of the breach.

I have been told that some advice she received suggested that TalkTalk waited until next week before saying anything publicly. That was seen as untenable.

'Awful truth'

Ms Harding used her interview with me to apologise to customers.

"I'm sorry, is the first thing I need to say," she said.

"It is a challenge for every single business. This is a criminal attack, this is a very serious issue and cyber-crime is on the rise. I would love to say this is just a TalkTalk issue but it isn't."

I asked Ms Harding whether all the data that was stolen was encrypted.

"The awful truth is, I don't know," she said.

"I would love to be able to give you that complete and unequivocal assurance. But it would be wrong of me to give you that today, when the amount of data that these criminals have had access to is very large.

"I don't want to give a false impression of confidence where I don't have it."

The question is, how many large companies know their systems are vulnerable to cyber-attacks?

I asked Ms Harding if she was "completely satisfied" with TalkTalk's security systems before Wednesday's attack.

"Every single company knows that there is more that they can do to keep themselves safe from cyber-crime," she said.

"Over the course of the last year, we as a company invested significantly.

"We've taken advice from some of the very best security experts, externally; from the security services themselves and we've been investing very heavily.

"So I firmly believe the business was taking security extremely seriously.

"With the benefit of hindsight - were we doing enough?

"We've got to say we weren't and obviously we will be looking back and reviewing that extremely seriously but my priority today is to make sure that I'm giving customers the information that they need and the support that they need to ensure that this crime doesn't actually affect them."