Some customers of Plusnet started getting a lot more junk e-mail in mid-May following the successful attack early in the month.

Loopholes

Plusnet attributed the attack to a "malicious third party" and said it was not sure how many e-mail addresses the hackers had stolen.

The attack was carried out via Plusnet's webmail service that lets customers get their messages via the net provider's website.

The list of addresses was for accounts customers used to get at the webmail system plus e-mail addresses in the online contacts lists and the addresses used to send e-mail from online accounts.

It said that as a result of the attack some customers may have downloaded a trojan, a type of malicious software.

But, it said, they would only have been at risk if their PC had no anti-virus software on it and had no patches installed.

In a statement, Neil Armstrong, products director at Plusnet, said: "After a full security audit, Plusnet's webmail service was taken offline permanently at midday Wednesday, 16 May, as a precaution against a number of minor potential security vulnerabilities that had not been exploited."

In a separate note to customers, Plusnet said it was "impossible" to close these unexploited loopholes.

Mr Armstrong said a replacement webmail service had now been set up for customers to get at their online accounts.

Mark Jackson, editor-in-chief of ISP Review, said of the incident: "Some people have taken it surprisingly well, while many others have been furious to see their once quiet mail folders flooded with junk."

He added: "However, the annoyance seems tempered by the fact that spam remains a huge problem for most surfers."