TalkTalk said information including customer names, addresses and bank details could have been compromised, and that it had informed London's Metropolitan Police Cyber Crime Unit.
"There is a risk that all of our customers' personal data has been accessed," chief executive Dido Harding told the BBC.
Police had no information on those behind the attack, but said they were "aware of speculation regarding alleged perpetrators".
The company has some four million broadband subscribers, and has offered customers free credit monitoring over the next year to spot unusual bank transactions.
TalkTalk shares plunged 6.89 percent to 250 pence on the London Stock Exchange in morning trading on Friday.