TalkTalk customers have been warned about scammers who managed to steal account numbers and names from the company's computers.
TalkTalk has set up a dedicated phone line for customers targeted in the attack.
A spokeswoman said the theft of data was unearthed when TalkTalk investigated a sudden rise in complaints from customers about scam calls between October and December 2014.
She said: "We have now concluded a thorough investigation working with an external security company, and we have become aware that some limited non-sensitive information may have been illegally accessed in violation of our security procedure."
The attackers managed to get some of TalkTalk's internal systems via a third party that also had access to its network. The information included names, addresses, phone numbers and TalkTalk account numbers. Legal action is now being taken against this unnamed third party.
In a statement TalkTalk said: "We are aware of a small, but nonetheless significant, number of customers who have been directly targeted by these criminals and we have been supporting them directly."
The hackers appear to be using the stolen details to trick people into thinking calls are coming from legitimate TalkTalk
customer service staff.
The firm said customers who had been caught out should contact their bank. The company also added that it was working with the Information Commissioners Office to identify the scammers and stop them from targeting customers.
Security expert Graham Cluley described the incident as "very worrying".
He said: "Rumours of a TalkTalk data breach have been bubbling up since December, but this is the first official confirmation that a serious incident has occurred.
"Unfortunately, it's unlikely that scammers and fraudsters are only targeting TalkTalk - there is a good chance that other telecoms companies have also been on the receiving end of attacks from hackers eager to steal customer data.
"Everyone needs to be on their guard for unsolicited emails and phone calls. If in doubt, go the extra mile to confirm that the person contacting you is legitimate."
Return to internet news headlines
View Internet News Archive