LONDON (AP) — Phone and Internet service provider Talk Talk said Friday that private data from its 4 million British customers may have been compromised in a "significant and sustained" cyberattack on its website.

Chief Executive Dido Harding said "there is a risk that all of our customers' personal data has been accessed," including credit card and bank details.

She said she was unable to say whether customers' information had been encrypted.

London's Metropolitan Police says its cybercrime unit is investigating "an allegation of data theft from a telecommunications website" reported on Wednesday.

Talk Talk has acknowledged that it realized it was under attack on Wednesday. It has been criticized for not telling customers for more than a day.

It is the third known cyberattack in a year on Talk Talk, which provides mobile phone, broadband Internet and pay television services.

Shares in the company plunged more than 7 percent Friday morning to 248.4 pence ($3.83) on the London Stock Exchange.