Chief Executive Dido Harding said "there is a risk that all of our customers' personal data has been accessed," including credit card and bank details.
She said she was unable to say whether customers' information had been encrypted.
London's Metropolitan Police says its cybercrime unit is investigating "an allegation of data theft from a telecommunications website" reported on Wednesday.
TalkTalk has acknowledged that it realised it was under attack on Wednesday. It has been criticised for not telling customers for more than a day.
It is the third known cyber-attack in a year on TalkTalk, which provides mobile phone, broadband Internet and pay television services.
Shares in the company plunged more than 7 percent Friday morning to 248.4 pence on the London Stock Exchange.
Catch the latest from the Consumer Electronics Show on Gadgets 360, at our CES 2026 hub.
Rockstar Games Said to Have Granted a Terminally Ill Fan's Wish to Play GTA 6
Oppo K15 Turbo Series Tipped to Feature Built-in Cooling Fans; Oppo K15 Pro Model Said to Get MediaTek Chipset