Chief Executive Dido Harding said "there is a risk that all of our customers' personal data has been accessed," including credit card and bank details.
She said she was unable to say whether customers' information had been encrypted.
London's Metropolitan Police says its cybercrime unit is investigating "an allegation of data theft from a telecommunications website" reported on Wednesday.
TalkTalk has acknowledged that it realised it was under attack on Wednesday. It has been criticised for not telling customers for more than a day.
It is the third known cyber-attack in a year on TalkTalk, which provides mobile phone, broadband Internet and pay television services.
Shares in the company plunged more than 7 percent Friday morning to 248.4 pence on the London Stock Exchange.
Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.
Samsung Galaxy Watch 9 (44mm, LTE)
Starts from ₹44,999
Samsung Galaxy Watch 9 (40mm, LTE)
Starts from ₹37,999
Samsung Galaxy Watch 9 (40mm)
Starts from ₹37,999
Haier M70 Mini LED 65-inch
Starts from ₹74,990
CMF Buds Neo True Wireless Stereo (TWS) Earphones
Starts from ₹2,199
Xiaomi TV FX Mini LED 65
Starts from ₹64,999
IFA 2026: Lenovo Unveiled New IdeaPad, Yoga and ThinkBook Laptops
IFA 2026: Nvidia RTX Spark PCs, Local AI Tools Announced With October Launch Planned
Luna Band Now Available Globally: Check Price in India, Specifications and Features