cyber.hendryadrian.com
Cyber Attack & Data Breach · therecord.media

UK Water Company Fined After Cl0p Remained in Its Network for Nearly Two Years

· Original article ↗

Summary

The UK ICO fined South Staffordshire Water £963,900 after finding Cl0p remained in its network for nearly two years. Weak monitoring, excessive privileges and unpatched ZeroLogon enabled the intrusion; data on 633,887 people was published.

Key points

  • The ICO fined South Staffordshire Water £963,900 over an intrusion that exposed personal data belonging to 633,887 customers and employees.
  • The intrusion began in September 2020 after an employee opened a malicious email attachment; the company discovered it in July 2022.
  • The article reports that about 4.1 terabytes of data were published, including names, addresses, bank details and National Insurance numbers.
  • An outsourced security operations center monitored only 5% of the company’s IT environment as of December 2021, and endpoint telemetry and logging were not integrated into its monitoring platform.
  • The ICO identified failures including use of a domain administrator account, no vulnerability scans, and unpatched domain controllers; the attacker exploited ZeroLogon.
  • The ICO’s penalty notice does not identify any compromise of operational or water-treatment systems.

Article Details

Victim Organization
South Staffordshire Water
Incident Type
Ransomware intrusion and data breach
Data Types Exposed
  • Names
  • Addresses
  • Dates of birth
  • Bank account numbers and sort codes
  • National Insurance numbers
  • Information from which disabilities could be inferred for a small percentage of customers
Affected Records
633,887 customers and employees
Affected Data Size
Approximately 4.1 terabytes of data published on the dark web
Operational Impact
The intrusion caused IT performance issues and exposed personal data. The penalty notice made no reference to compromise of operational or water treatment systems.
Ransom Or Extortion
The attacker unsuccessfully attempted to distribute a ransom note to certain staff. The article also describes a bungled extortion attempt.
Claim Status
confirmed

People

Charley MaherSouth Staffordshire’s chief executive; acknowledged the ICO’s decision and described the company’s response and security improvements.Ian HulmeAs the ICO’s Interim Executive Director for Regulatory Supervision, commented on the ICO’s findings and the need for proactive security.

Threat Actors

Cl0pIdentified in the article as the ransomware group responsible for the intrusion. The group remained in South Staffordshire Water’s network for nearly two years, and the attack resulted in personal data being published.

Products

Windows Server 2003Some devices were also still running Windows Server 2003, an operating system whose extended support ended in July 2015.

Countries

United Kingdomnetwork for nearly two years before the intrusion came to light through an IT performance slowdown, the UK’s data protection regulator has found.

Related Articles