South Staffordshire Water Fined £963,900 Following Two-Year Data Breach
The UK’s Information Commissioner’s Office has fined South Staffordshire Water’s parent company nearly £1 million for security failures that allowed hackers to remain undetected in its network for 20 months.
The UK’s Information Commissioner’s Office (ICO) has issued a £963,900 fine to the parent company of South Staffordshire Water following a massive data breach that compromised the personal information of over 633,000 individuals Help Net Security. The incident, which remained undetected for nearly two years, highlights significant lapses in the utility provider's cybersecurity posture and data protection practices.
The security failure originated in September 2020 when an employee fell victim to a phishing email, allowing attackers to deploy malicious software within the company’s network Help Net Security. The intruders maintained persistent access for 20 months, during which they exfiltrated approximately 4.1 terabytes of data that was eventually published on the dark web. The breach was only discovered in July 2022 after IT performance issues triggered an internal investigation, followed shortly by the discovery of a ransom note that the attackers had attempted to distribute to staff Help Net Security.
The compromised data was extensive, encompassing names, addresses, dates of birth, bank account details, and National Insurance numbers. Crucially, the exposed information included records from the Priority Services Register, which could allow third parties to infer sensitive details regarding customer disabilities Help Net Security. At the time of the incident, the company held data for approximately 1.85 million current and former customers.
The ICO’s investigation uncovered a series of systemic security failures that facilitated the long-term intrusion. These included the use of unsupported software, such as Windows Server 2003, and inadequate vulnerability management, characterized by missing security scans and unpatched systems Help Net Security. Furthermore, the company maintained weak access controls that allowed attackers to escalate their privileges to administrator levels, while its monitoring infrastructure covered only 5% of the total IT environment Help Net Security.
In response to the findings, the ICO emphasized that proactive security is a legal requirement rather than an optional measure, particularly for organizations managing critical national infrastructure Help Net Security. While the ICO initially signaled its intent to fine the company in December 2025, the final penalty was reduced by 40% after South Staffordshire admitted liability and agreed to settle the case without pursuing an appeal Help Net Security.
This incident serves as a stark reminder of the risks posed to critical infrastructure providers when basic security hygiene is neglected. The case underscores the importance of robust monitoring, timely patching, and the retirement of legacy systems, as regulators continue to hold organizations accountable for the protection of sensitive customer data entrusted to them by necessity Help Net Security.