A 17-year-old boy who hacked into the broadband service provider TalkTalk and exposed its vulnerabilities has pleaded guilty to seven offences.
Appearing at Norwich youth court on Tuesday, the teenager, who cannot be named for legal reasons, admitted he was “showing off to his mates” when he posted details of his success online.
While he did not exploit the information for gain, the TalkTalk website was targeted more than 14,000 times after he initially broke through its security using a “hacking tool”, said Laura Tams, prosecuting.
The youth was arrested in Norwich on 3 November last year and charged with breaching the Computer Misuse Act 1990 following an investigation by the Metropolitan police’s cybercrime unit. Sentencing has been adjourned until 13 December.
Tams said police raided the teenager’s home after he was identified as having been involved in the TalkTalk breach. An iPhone, USB stick and Apple laptop were seized and analysed. They showed the teenager had been involved in attacks on other websites including those of Manchester University, Cambridge University and Merit Badges, a small family company that supplies martial arts badges.
The prosecutor said the boy used software called SQLmap to identify vulnerabilities on websites.The “legitimate software” gave a legal disclaimer warning to users that it must only be used to identify vulnerabilities on websites with mutual consent, she said.
In a Skype conversation on the day of the breach, the teenager told a friend he had “done enough to go to prison”. Chris Brown, in mitigation, said the teenager had not discovered the vulnerability and it had been discussed by other people before his breach. Hundreds of attempts were made by others, but the teenager’s attempt was successful.
Brown said of the boy’s actions: “It’s inexplicable to the rest of us: why get in so much trouble for what’s bravado – to prove you can, to prove you’ve got the skills?” The teenager’s role, he added, was limited to “signposting”.
The boy, who admitted he knew his actions were illegal, told magistrates: “I didn’t really think of the consequences at the time. I was just showing off to my mates.”
The chair of the bench, Jean Bonnick, said magistrates were minded to spare the teenager prison but further reports were needed first.
TalkTalk fell victim to what it described as a “significant and sustained” attack on its website on 21 October 2015, which resulted in the personal data of nearly 160,000 people being accessed. The Information Commissioner’s Office said that in 15,656 cases, bank account details and sort codes had been accessed. In May, the firm said the fallout from the cyber-attack had cost it £42m.
A second teenager has been charged in a separate case over the alleged hack and data theft.
Daniel Kelley, 19, of Heol Dinbych in Llanelli, faces eight charges of blackmail, four of computer hacking and two of fraud. He is due to appear at the Old Bailey on Friday for a plea and trial preparation hearing.
It is alleged that he hacked TalkTalk to get customer data and demanded a payment worth about £216,000 in bitcoins, an online currency. Prosecutors claim that he carried out similar attacks on other firms including an educational business in Australia in 2015.