Although executives said the overall impact of the TalkTalk hack may have been limited to only 4 percent of its customer base, the U.K. Internet service provider (ISP) could still be dealing with an estimated financial hit of $53 million.

BBC News reported that the total number of victims whose bank account codes and other data was stolen in the TalkTalk hack is now believed to be about 157,000. That’s a steep drop from its initial analysis following the cyberattack about two weeks ago, when the firm thought up to 1.2 million customers might have been affected. The FT said an additional 28,000 also had credit and debit card numbers stolen, but they were obscured in the records and would be unusable by the attackers.

Although the majority of the company’s customers will no doubt be relieved, the long-term consequences of the TalkTalk hack could be far-reaching. Beyond the financial repercussions the telecom firm faces, the incident has sparked a parliamentary inquiry into how cybercriminals were able to conduct a data breach so easily, Wired noted. The change in estimated victims may also raise some debate among security experts about whether companies should inform their entire customer base of an issue until they know more about the extent of the damage.

So far, police have arrested four teenagers in the investigation, but that doesn’t do much to address a more urgent matter: Ever since the TalkTalk hack, customers haven’t been able to access their accounts online, according to PCAdvisor. Though the company is offering some workarounds, it has also suggested customers monitor their accounts for any potential signs of data loss and remain vigilant against any phone scams or other possible attempts by cybercriminals to exploit the situation.

The other sore point in all this is the fact that the latest TalkTalk attack was the third it has experienced in 2015, Slashgear said. That means even if the incident doesn’t affect its profits, the damage to the ISP’s reputation could take some time to recover, especially if the government finds its security policies were insufficient in any way. At the very least, the customers who remain loyal should change their passwords and take any other self-service steps to protect their data as quickly as possible.