A 17-year-old boy who admitted hacking offences linked to the TalkTalk data breach has been given a 12-month youth rehabilitation order and had his iPhone and computer hard drive confiscated.
The teenager, who cannot be named for legal reasons, found a vulnerability in the website using “legitimate software” and shared details of this online, an earlier hearing at Norwich Youth Court was told.
While he did not exploit the information for gain, the TalkTalk website was targeted more than 14,000 times after the boy exposed the vulnerability. The firm said the fallout from the cyber attack in October 2015 cost it £42 million and the personal data of nearly 160,000 people was accessed.
The teenager told magistrates “I was just showing off to my mates” as he admitted seven hacking offences.
In a Skype conversation on the day of the breach, he told a friend he had “done enough to go to prison”.
Sentencing him yesterday, chair of the bench Jean Bonnick said: “Your IT skills will always be there – just use them legally in the future.”
Two of the seven charges related to the TalkTalk hack, and the boy also admitted targeting other websites including Manchester University, Cambridge University and that of Merit Badges, a small family company which supplies martial arts badges.
An application to lift reporting restrictions and name the teenager was refused by magistrates.
Chris Brown, mitigating, said there had been full reporting of the facts of the case, the application should have been made sooner and naming the teenager could harm his rehabilitation.
He said: “Part of the work that’s ongoing is to draw him out of his bedroom and into the family and properly into the public arena, to someone who doesn’t hide behind a computer for nefarious purposes.
“He has already committed an offence that has changed his life within his family, his home, his future prospects.
“I would ask you don’t expose that to the world for him to continue to bear that burden through his young life.”
The teenager, who sat with his mother in court, spoke only to confirm that he understood the proceedings.
The teenager must complete 24 hours of activities as part of the youth rehabilitation order, and he was ordered to pay £85 court costs and a £15 victim surcharge.