Dido Harding is unfit
It's clear that her whole attitude is one of being slopey-shouldered about taking any responsibility. Her attitude to the hack not only is to view it as not her problem, that TalkTalk is the victim of a crime, but her interview on Newsnight had her pulling a load of whataboutery about how many other cyber attacks there were.
And it's not like this is Laura Ashley you're running. I might understand if someone selling soft furnishings seemed to be clueless about data, but data is your bread and butter at an ISP. You shouldn't even have any systems with SQL injection in such an organisation, because you should have figured out a mitigation strategy that can be applied globally (like using an ORM) and sometime in the past decade, that should have been a priority.
I'd love to know who does their IT. What's the odds it's some outfit that bid the lowest price stuffed full of guys from Bangalore straight out of college?