U.K. ISP TalkTalk on Wednesday was hit with a "significant and sustained cyber attack."
The website breach means "there is a chance" that customers' personal data was compromised, including names, addresses, date of birth, phone numbers, email addresses, TalkTalk account information, credit card details and/or bank details.
"We are continuing to work with leading cyber crime specialists and the Metropolitan Police to establish exactly what happened and the extent of any information accessed," the company said.
"TalkTalk constantly updates its systems to make sure they are as secure as possible against the rapidly evolving threat of cyber crime, impacting an increasing number of individuals and organizations," CEO Didi Harding said in a statement. "We take any threat to the security of our customers' data extremely seriously and we are taking all the necessary steps to understand what has happened here."
According to the BBC, Harding received a ransom email demanding money. Presumably, those hackers have threatened to dump customers' personal data online, a la Ashley Madison, but Harding did not elaborate.
TalkTalk has contacted customers to inform them of the breach and advise them on what to do. Major banks are also keeping an eye out for suspicious activity in users' accounts.
In a FAQ section on its Help website, the telecom admitted that "not all of the data was encrypted," but said it believes its systems were "as secure as they could be."
"Unfortunately TalkTalk is by no means an isolated incident," the company said, citing other targets like banks, retailers, and the U.S. government. "Barely a week goes by now without cybercriminals using increasingly hostile and sophisticated methods to target companies that do business online."
In August, British mobile phone retailer Carphone Warehouse detected a breach that may have leaked personal details of up to 2.4 million customers.
This isn't the first TalkTalk breach, though. Earlier this year, it confirmed a late-2014 hack in which attackers stole names, addresses, phone numbers, and customer account numbers.