UK ICO Fines Water Companies £963,900 Over Customer Data Breach
Summary
The ICO fined South Staffordshire Water Plc and South Staffordshire Plc £963,900 after confirming leaked data was authentic. Its investigation found a phishing-led breach and serious security failures.
Key points
- The ICO fined South Staffordshire Water Plc and parent company South Staffordshire Plc £963,900; the penalty was reduced by 40% after they admitted liability, cooperated, and agreed not to appeal.
- The article reports 663,887 affected customers and employees, while its quoted ICO announcement says 633,887 people.
- The ICO confirmed that leaked data was authentic. The exposed information included contact and account details, bank information, and employee HR data.
- A phishing attack in September 2020 enabled malware installation; attackers later escalated privileges and gained domain administrator access between May and July 2022.
- The malware went undetected for 20 months, and the breach was discovered in July 2022 after IT performance problems prompted an investigation.
- The ICO cited monitoring of only about 5% of the IT environment, obsolete software, poor vulnerability and patch management, and a lack of regular security scans.
Article Details
- Event Type
- Regulatory fine following a data breach at a water supplier.
- Impact
- The ICO fined South Staffordshire Water Plc and South Staffordshire Plc £963,900 after confirming that data exposed in the breach was authentic. The article reports 663,887 affected customers and employees in its summary, but quotes the ICO as saying 633,887 people. Exposed information included contact and account details, bank details, dates of birth, and employee HR data. The breach disrupted IT operations and exposed security failures including limited monitoring, obsolete software, and poor patch management.