Around 21,000 unique bank account numbers and sort codes were accessed in the TalkTalk cyber attack, the firm said on Friday.
ITV News understands the bank details were unencrypted.
The firm insisted the data hacked was "significantly less than originally suspected".
Earlier, police confirmed that a second boy has been arrested in connection with the alleged attack.
A 15-year-old boy in Northern Ireland has been arrested in connection with the TalkTalk security breach.
The Metropolitan Police said the boy, from County Antrim, was arrested at around 4:20pm today by officers from the Police Service of Northern Ireland (PSNI) on suspicion of Computer Misuse Act offences.
As TalkTalk finally confirms the real extent of its data breach, it's time for the company to be more open with customers.
Around 21,000 unique bank account numbers and sort codes were accessed in the TalkTalk cyber attack, the firm said on Friday.
Police have made a second arrest, a 16-year-old boy from Feltham, in connection with the investigation into alleged TalkTalk data theft.