Thursday 1 December 2016 23.02 GMT
More than 100,000 people in the UK have had their internet access cut after a string of service providers were hit by what is believed to be a coordinated cyber-attack, taking the number affected in Europe up to about a million.
Talk Talk, one of Britain’s biggest service providers, the Post Office and the Hull-based KCom were all affected by the malware known as the Mirai worm, which is spread via compromised computers.
The Post Office said 100,000 customers had experienced problems since the attack began on Sunday and KCom put its figure at about 10,000 customers since Saturday. Talk Talk confirmed that it had also been affected but declined to give a precise number of customers involved.
Earlier this week, Germany’s Deutsche Telekom said up to 900,000 of its customers had lost their internet connection as part of the same incident.
No one has claimed responsibility for the attack, which both Deutsche Telekom and KCom said was part of a worldwide effort. Security experts said the hackers may have been Russian but they had no proof.
The speculation led the German chancellor, Angela Merkel, to say that, while she could not be sure who was responsible for the strike, “such cyber-attacks, or hybrid conflicts as they are known in Russian doctrine, are now part of daily life and we must learn to cope with them”.
The Mirai worm takes control of devices running the Linux operating system and uses them to knock services offline. This attack has targeted certain types of broadband routers, damaging their internet connection.
A similar attack on the US-based Dyn web domain provider in October
knocked a host of prominent websites offline, including Spotify, Twitter and Reddit.
Security experts have suggested the aim of the attack may have been to simply cause disruption. “When the modified Mirai attack hit Deutsche Telekom over the weekend, many guessed that the fact that it simply shut down the devices it hit was a mistake by the bad guys trying to steal data,” said Jonathan Sander, from the security firm Lieberman Software.
“Now that Post Office routers are falling victim to the same type of attack shutting them down, it begs the question if the shutdown is the goal. Most cybercrime is about money. But every now and then there are bad guys who just want to watch the world burn.”
TalkTalk said: “Along with other internet service providers in the UK and abroad, we are taking steps to review the potential impacts of the Mirai worm. A small number of customer routers have been affected and we have deployed additional network-level controls to further protect our customers.”
A spokeswoman declined to put a number on the number of people affected. She said: “Only a small percentage of our customers have the affected router and, of those, only a very small number have experienced connection issues as a result.”
A Post Office spokesperson confirmed a “third party disrupted the services” of its broadband customers on Sunday. “Although this did result in service problems, we would like to reassure customers that no personal data or devices have been compromised,” he said. “We have identified the source of the problem and implemented a resolution which is currently being rolled out to all customers. No other Post Office services were affected.”
KCom said it had been affected since Saturday but the vast majority of its customers were now able to connect to and use their broadband service as usual.
A spokesperson said: “Our core network was not affected at any time and we have put in place measures to block future attacks from impacting our customers … We have provided formal notification of the attacks to the communications regulator, Ofcom, and will continue to work with other UK communications providers to ensure a consistent approach to mitigating this threat.”