Around 21,000 unique bank account numbers and sort codes were accessed in the TalkTalk cyber attack, the firm said on Friday.
ITV News understands the bank details were unencrypted.
The firm insisted the data hacked was "significantly less than originally suspected".
Earlier, police confirmed that a second boy has been arrested in connection with the alleged attack.
A 16-year-old boy has become the fourth person arrested in connection with the cyber attack on telecoms company TalkTalk.
The teenager was arrested in Norwich on Tuesday evening, Scotland Yard said.
He remained in custody at a local police station as searches continued at the property where he was detained.
A 20-year-old man from Staffordshire, a 16-year-old boy from London and a 15-year-old boy County Antrim in Northern Ireland have also been arrested in connection with the incident.
A Metropolitan Police spokesman said: "On the evening of Tuesday, 3 November, detectives from the Metropolitan Police Cyber Crime Unit and officers from the National Crime Agency executed a search warrant at an address in Norwich.
"A 16-year-old boy was arrested at the address on suspicion of Computer Misuse Act offences. He currently remains in custody at a local police station."
As TalkTalk finally confirms the real extent of its data breach, it's time for the company to be more open with customers.
Around 21,000 unique bank account numbers and sort codes were accessed in the TalkTalk cyber attack, the firm said on Friday.
Police have made a second arrest, a 16-year-old boy from Feltham, in connection with the investigation into alleged TalkTalk data theft.