An unnamed 15-year-old boy has been arrested in relation to the massive hack and subsequent data breach of United Kingdom telco TalkTalk Telecom Group PLC.

The boy, a resident of County Antrim, Northern Ireland was arrested on suspicion of breaching the Computer Misuse Act, a U.K. law that covers unauthorized access to computer material, unauthorized access with intent to commit or facilitate a crime, and unauthorized modification of computer material.

“He has been taken into custody at a County Antrim police station where he will later be interviewed. A search of the address is ongoing and inquiries continue,” Scotland Yard said in a statement while noting that the investigation included the Metropolitan Police Force’s cyber crime unit, the Police Service of North Island’s cyber crime center and the National Crime Agency.

TalkTalk told The Belfast Herald that they had been informed of the arrest and added that “we know this has been a worrying time for customers and we are grateful for the swift response and hard work of the police. We will continue to assist in the ongoing investigation.”

News of the hack first came to light late last week when TalkTalk issued a statement.

The data breaches, going back over eight months, involved access to unencrypted data, along with the perhaps not so surprising “pay us Bitcoin to not release the data” extortion attempt by someone alleging to be the person behind the attack; whether it was the 15-year-old arrested here is not clear from reports, although given the speed in which he was arrested it would seem that there would be a reasonable expectation that it could be the extortion attempt that led to the arrest.

Script kiddie

While it’s not unknown for 15-year-olds to be talented hackers, they are very few and far between, whereas script kiddies are far more common.

While not confirmed it’s still believed that the data breach was undertaken using something as simple as an SQL injection, or as noted in our previous coverage:

the intrusion started with an attack technique known as SQL injection (SQLi), a method which abuses a misconfiguration in a database that causes the database to cough up or dump information. The source said the SQLi attack was punctuated by a denial-of-service attack that sought to prevent legitimate users from visiting the targeted site, and that the debilitating assault may have been launched to distract from the database hack.

It doesn’t take a genius hacker seen in the likes of a Hollywood movie to undertake SQLi combined with a denial-of-service attack versus scripts easily obtainable not only on the Darkweb but on the regular web as well.

In 2015 it also doesn’t take a brilliant team of cybersecurity professionals to protect against this sort of attack either, and TalkTalk has a lot to answer for in terms of its deficient security.

Image credit: loopzilla/Flickr/CC by 2.0