Around 21,000 unique bank account numbers and sort codes were accessed in the TalkTalk cyber attack, the firm said on Friday.
ITV News understands the bank details were unencrypted.
The firm insisted the data hacked was "significantly less than originally suspected".
Earlier, police confirmed that a second boy has been arrested in connection with the alleged attack.
An 18-year-old man has been arrested on suspicion of blackmail over the TalkTalk hack.
Personal details of thousands of customers were accessed in the cyber attack at the end of last month.
It is the fifth arrest in a Met Police investigation into alleged data theft from the communications company.
Police said the teenager was detained at an address in Llanelli, Wales and remains in custody.
A 15-year-old boy from County Antrim, two 16-year-old boys from Feltham and Norwich and a 20-year-old man from Staffordshire have also been arrested over the hack.
All were questioned on suspicion of Computer Misuse Act offences and were released on bail.
As TalkTalk finally confirms the real extent of its data breach, it's time for the company to be more open with customers.
Around 21,000 unique bank account numbers and sort codes were accessed in the TalkTalk cyber attack, the firm said on Friday.
Police have made a second arrest, a 16-year-old boy from Feltham, in connection with the investigation into alleged TalkTalk data theft.