Around 21,000 unique bank account numbers and sort codes were accessed in the TalkTalk cyber attack, the firm said on Friday.
ITV News understands the bank details were unencrypted.
The firm insisted the data hacked was "significantly less than originally suspected".
Earlier, police confirmed that a second boy has been arrested in connection with the alleged attack.
TalkTalk has received a ransom demand from someone claiming to be behind a cyber attack which may have resulted in sensitive data belonging to millions of its customers being stolen, the company said.
The telecoms giant is investigating whether credit card and bank details were taken in Wednesday's attack, the third time this year it has been the victim of a cyber crime.
TalkTalk has advised customers to check their bank accounts over the next few months and to report any unusual activity.
A TalkTalk spokeswoman said: "We can confirm we were contacted by someone claiming to be responsible and seeking payment."
As TalkTalk finally confirms the real extent of its data breach, it's time for the company to be more open with customers.
Around 21,000 unique bank account numbers and sort codes were accessed in the TalkTalk cyber attack, the firm said on Friday.
Police have made a second arrest, a 16-year-old boy from Feltham, in connection with the investigation into alleged TalkTalk data theft.