He was arrested on Monday and questioned by police overnight, and released on police bail first thing this morning.
Police in Ballymena, Northern Ireland, arrested the boy on suspicion of breaking the Computer Misuse Act.
Meanwhile, TalkTalk has moved to restrict people with contracts from simply leaving the service and taking their business elsewhere.
It will only release customers from terminating their contracts if there is evidence that money has been stolen, and that is only a “gesture of goodwill”, the company said.
TalkTalk said over last weekend that the attack wasn’t as far reaching as it first thought.
The company has four million UK customers.