Around 21,000 unique bank account numbers and sort codes were accessed in the TalkTalk cyber attack, the firm said on Friday.
ITV News understands the bank details were unencrypted.
The firm insisted the data hacked was "significantly less than originally suspected".
Earlier, police confirmed that a second boy has been arrested in connection with the alleged attack.
A 20-year-old man from Staffordshire is the third person to be arrested in connection with alleged data theft from TalkTalk, the Metropolitan Police have said.
He is being held on suspicion of offences under the Computer Misuse Act and remains in custody at a local police station.
As TalkTalk finally confirms the real extent of its data breach, it's time for the company to be more open with customers.
Around 21,000 unique bank account numbers and sort codes were accessed in the TalkTalk cyber attack, the firm said on Friday.
Police have made a second arrest, a 16-year-old boy from Feltham, in connection with the investigation into alleged TalkTalk data theft.