Home / Crime and Justice / Water Firm Fined £963,900 for Massive Data Breach
Water Firm Fined £963,900 for Massive Data Breach
12 May
Summary
- A water company was fined over £960,000 for a significant data breach.
- The cyber attack exposed personal data of over 633,000 customers.
- Phishing email allowed undetected malicious software for 20 months.
A significant data breach has resulted in South Staffordshire water company receiving a £963,900 penalty from the Information Commissioner's Office (ICO).
The cyber attack, initiated by a phishing email in September 2020, allowed malicious software to go undetected within the company's systems for two years.
Between May and July 2022, hackers gained administrator privileges and exfiltrated the personal information of 633,887 customers. This data, including bank details and staff National Insurance numbers, was subsequently published on the dark web.
The ICO found the company lacked adequate security controls, used obsolete systems, and had minimal monitoring, enabling the breach. The company accepted liability and agreed to the penalty without appeal.
