TalkTalk is looking into reports of a potential data breach after a hacker boasted they’d swiped personal details belonging to millions of its users. The telecoms giant admits something’s up but says the hacker’s claims are way off the mark.

The cybercriminal, who goes by the handle “b0nd,” posted on a shady online forum claiming they’d nicked data from over 18.8 million TalkTalk customers—both current and former. For sale? Info like names, email addresses, phone numbers, IP addresses, and even subscriber PINs. Yikes.

But TalkTalk insists the hacker’s numbers are way overblown. A company rep pointed out that TalkTalk currently has around 2.4 million customers, not close to the 18.8 million figure being thrown around. “The claims made are completely wrong and exaggerated,” they said.

So, what happened? TalkTalk says it spotted “unexpected access” to one of its third-party suppliers’ systems. No financial or billing info was stored there, the company assured, but some customer details were. Screenshots shared by the hacker hint the data may have been swiped from CSG’s Ascendon platform, which TalkTalk uses to manage subscriptions. CSG hasn’t commented yet.

This isn’t TalkTalk’s first rodeo with data breaches. Back in 2015, hackers stole personal info from 157,000 customers, including financial details. The U.K.’s Information Commissioner slammed the company for not having basic cybersecurity in place, leading to a hefty £400,000 fine.

For now, TalkTalk is working to contain the situation and protect its customers. Stay tuned for updates as this story unfolds.