When Your Water, Energy or Phone Company Is Hacked

When a water, energy or phone company is hacked, two separate things can go wrong, and it helps to keep them apart. The first is supply: an attack on the company's systems can disrupt the equipment and staff that keep water flowing or power on. The second is your data: if the company holds your account details, a breach can put them in criminal hands. Most utility cyber attacks in the UK have hit the second, not the first, but the risk to supply is real and taken seriously. A parliamentary committee reported that in August 2022, South Staffordshire Water was targeted by ransomware actors who claimed to have accessed systems that control industrial processes at the company's water treatment plants¹.

Your water company remains the best source of information during any interruption to your supply², and the regulator Ofwat sets out what communication you should expect from your water company when supply is interrupted³. In a genuine supply emergency the company must provide safe alternative drinking water, such as bottled water, if you are advised not to drink from the mains⁴. This page explains what has actually happened in UK utility cyber attacks, what to do if your supplier announces one, how to check your water is safe, and how to make sure anyone who calls at your door really is from the company. For the wider picture of life when services go offline, see our guide to cyber attacks and major IT failures.

Water supply cyber attacks: what has happened so far

Cyber attacks on water treatment plants are a recognised cause of utility failure in the UK, listed alongside sabotage as a threat to water infrastructure⁸. The clearest UK example is South Staffordshire Water. In August 2022, during a drought, the company was targeted by ransomware actors who claimed to have accessed systems that control industrial processes at its water treatment plants¹. The attack was investigated and reported by a parliamentary committee, which noted that ransomware is typically experienced by businesses, charities and public sector organisations rather than households directly¹. The same committee reported that in September 2023 the Lockbit ransomware group released data from the Ministry of Defence after an attack on a metal fencing company, Zaun, which supplied sites such as the Porton Down research unit, showing how an attack on one supplier can spill data belonging to others¹.

The NHS gives the fullest picture of what a ransomware attack on an essential service actually does to the public. On Friday 12 May 2017 the global ransomware attack known as WannaCry affected more than 200,000 computers in at least 100 countries⁹. NHS Digital's CareCERT service alerted the Department of Health just after 13:00 that day after reports from four NHS trusts, and at 4 pm NHS England declared the attack a major incident and implemented its emergency arrangements to maintain health and patient care¹⁰. The National Audit Office called WannaCry the largest cyber attack to affect the NHS in England, and assessed it as a relatively unsophisticated attack that could have been prevented by following basic IT security best practice¹¹. Earlier, on 13 January 2017, Barts Health NHS Trust suffered a cyber attack affecting four London hospitals and shut down its file-sharing system to investigate⁹.

More recently, in June 2024, a ransomware attack on Synnovis, a pathology laboratory processing blood tests for NHS organisations primarily in south-east London, significantly reduced its capacity to process tests¹². The attack led to 10,152 acute outpatient appointments and 1,710 elective procedures being postponed at King's College Hospital NHS Foundation Trust and Guy's and St Thomas' NHS Foundation Trust¹². These incidents are covered in detail on our pages about WannaCry and the Synnovis incident.

If your supplier announces a cyber attack

If your water, energy or phone company announces it has been hacked, the first thing to do is go to the company's own website and check for information about your area. Your water company is the official source of information during an interruption, and you should check their website regarding service in your area and whether you can pick up alternative sources of water². Ofwat, the water regulator, provides information on what communication you should expect from your water company in the case of an interruption to supply³. If you are unsure who your water supplier is, you can find out by entering your postcode on the Water UK website⁶.

Be aware that communication from water companies has not always been reliable. Ofwat's review of the March 2018 supply disruptions, known as the "Thaw" incident, found that 40% of customers impacted in seven of the worst affected areas received no communication from their water company during the incident¹³. Ofwat identified Severn Trent Water, South East Water, Southern Water and Thames Water as needing detailed scrutiny because of substantial concerns with their handling of the incident and the volume of customers left without supply for more than four hours¹³. Some companies did nothing to communicate with customers until problems with water supplies emerged, and did not have enough staff available to deal with the level of enquiries¹³. Ofwat also found that companies should not rely on a few digital channels, such as Twitter, to provide updates, as these did not reach a large proportion of customers¹³.

That review cuts both ways for you. It means you should not assume that no news from your supplier means no problem, and it means you should check more than one channel: the company's website, where you can search on your postcode to see notifications of what is going on in your area¹⁴, and local news. Some companies did communicate well: Yorkshire Water, South Staffs Water, Welsh Water (Dŵr Cymru) and United Utilities made advance contact with customers, with Welsh Water and United Utilities each sending over 90,000 messages over email, SMS and voice blast¹³. If you identify an issue with the water supply, alert your water company, and make sure you know the emergency supply number for your water company¹⁵. Our page on how services respond to major incidents explains the roles of regulators and responders in more depth.

Do not drink notices and alternative supplies

A cyber attack on a water company does not normally change your water, but if the company or the authorities ever suspect the water is unsafe, you will be told. The clearest instruction is a Do Not Drink notice. If advice is given not to drink water from mains or other supplies, safe alternative drinking water will be provided⁴. Water companies maintain plans for water supply incidents covering alternative water supplies and the prioritisation of vulnerable customers, and those plans are regularly exercised and tested¹⁶.

A real example shows how this works. In August 2025, following a loss of supply affecting Shotton Mill consumers on Broughton Mains, the company issued Do Not Drink advice, displayed notices at all outlets, and provided bottled water as an alternative drinking supply¹⁷. That incident was not a cyber attack, but the response is the same whatever the cause: notices at the outlets, an explicit Do Not Drink instruction, and bottled water supplied.

There are limits to what you should expect. Water companies may not always be able to provide an emergency supply of water in bowsers or in bottles, for example if they have their own ongoing emergency such as a burst main¹⁸. So it is worth keeping some bottled water at home as a matter of course, as local resilience guidance advises: keep bottled water available, check your supplier's website for information and updates, follow the instructions of the emergency services and your local authority, and make yourself known to your local authority if you are vulnerable or have additional needs for water¹⁵. For how much water to store and how to use it safely, see our guide to water in an emergency.

Password schemes: how to know a caller is genuine

After any incident that puts a utility's customer service under strain, bogus callers become more likely. The Department of Health has warned people to keep an eye out for bogus officials who may call door-to-door without an appointment, claiming to be from heating supply or other companies checking for problems, and advises that you always check the identity of callers to your home and, if in doubt, call the police¹⁹. The strongest protection available is a password scheme.

Water companies and energy suppliers both run these schemes. Surrey County Council's guidance for priority customers explains that water companies use a password you give them, so you know who they are when they knock on your door²⁰. In the energy sector, the Priority Services Register includes a password scheme to help customers identify energy company representatives, offered by suppliers, distribution network operators and gas distribution networks to disabled, chronically sick and pensionable age customers²¹. If you are eligible for the Priority Services Register, it is worth signing up: see our guide to extra help in an emergency.

South East Water sets out the scheme plainly:

South East Water, staying safe online and in the home⁵

To set up a password with South East Water, call 0333 000 0001⁵. Only you and the company's genuine employees will know what your password is⁵. If you forget your password, ring the company on the number on your bill or its website and reset it; never let a caller in because you feel awkward asking.

Random water tests and what staff wear

One reason a water company employee may knock without warning is a random water test. Under the Water Supply (Water Quality) Regulations 2016, water companies sometimes carry out random tests on water from customers' taps⁵. Because these tests are random, the company will not be able to make an appointment before visiting, but staff will always wear a company uniform and show their identity card⁵. It is also a statutory requirement that samples are representative of the water in supply⁶, and companies will normally take a sample in response to a complaint from a consumer, depending on the nature of it⁶.

This is where the password scheme and the uniform come together. South East Water states that all its employees wear uniforms and drive vehicles with the company logo, and carry photo ID, and asks customers to request the ID if they are not sure⁵. Southern Water's code of practice says all its employees carry Southern Water photo identity cards, advises you to attach your door chain before opening the door to strangers, and if unsure, to keep them out and call 0330 303 0368, a 24-hour line²². Southern Water also runs a 24-hour leak line on 0800 820 999²².

The practical checklist for any unannounced caller is short:

• Ask for your password. If they do not know it, do not let them in⁵.
• Ask to see a photo identity card, even if the caller is in uniform⁵.
• Look for a branded vehicle if you can see one⁵.
• Put the door chain on before opening the door to strangers²².
• If still unsure, keep them out and call the company's published number yourself²².
• If you believe the caller is bogus, call the police¹⁹.

If your data was taken in the breach

The second half of a utility hack is your data. Passwords are often stolen when an organisation holding your details suffers a data breach²³, and criminals then trick people into revealing more by creating fake phishing emails or SMS messages that link to scam websites²³. After a breach, the National Cyber Security Centre (NCSC) advises you to check whether your details have appeared in other public data breaches using online tools such as haveibeenpwned.com, and notes that similar services are often included in antivirus or password manager tools⁷. The NCSC's guidance on sextortion scams gives the same service: you can check if your account has been compromised and get future notifications by visiting haveibeenpwned.com²⁴. Our page on checking whether your email was in a breach walks through this step by step.

Then protect the accounts that matter. Use strong passwords and a different password for every online account⁵, and do not reuse the same password on different online accounts²⁵. If you use a password manager, the NCSC advises you to switch on two-step verification (2SV) on the password manager account, so a cyber criminal who knows the primary password still cannot access it²⁶. If an account has actually been hacked, check your email filters and forwarding rules, because cyber criminals are known to set up a forwarding rule to automatically receive a copy of all emails sent to your account, which could allow them to reset your passwords²⁷. See our guides on hacked accounts and email forwarding rules.

Be alert to approaches that follow a breach. NHS England, after the Synnovis incident, told patients to always be alert to approaches from anyone claiming to have your data, and to be alert to suspicious calls or emails asking for personal or financial data²⁸. It also confirmed that Synnovis would not be contacting patients directly, and that notification would come from an NHS organisation, as determined by UK data protection laws²⁸. The same principle applies to utilities: a genuine company will not ring you out of the blue to ask for your bank details. Our page on scam messages after a data breach covers the follow-on frauds in detail.

Ransomware, water safety and hospital services

Ransomware is the most likely form a utility attack will take. West Yorkshire Prepared describes ransomware as a threat to Critical National Infrastructure that poses a risk to national security, with impacts including financial, data and service losses, which can lead to business closure, inaccessible public services and compromised customer data²⁹. The NCSC has called ransomware one of the most significant cyber security threats facing businesses and organisations in the UK, and joined forces with the FBI, CISA, the National Security Agency and the ACSC to highlight an increase in sophisticated, high-impact ransomware incidents against critical infrastructure organisations globally³⁰. During the year to 31 August 2022, the NCSC co-ordinated the national response to 18 ransomware attacks, including attacks on a sports body and a utility company³⁰. Targets may include local government systems, healthcare providers, schools and businesses³¹, and essential public services, including emergency response, transportation and utilities, could be interrupted³¹.

For your household, three points follow. First, ransomware attacks on utilities attack computers, not water: companies still test water daily in your area under legal duties and will give you the results free of charge on request⁶. If water quality were ever at risk, you would receive a Do Not Drink notice and an alternative supply⁴. Second, an attack can still disrupt services, as the NHS experience shows. After Synnovis, hospitals not affected by the attack created capacity to take patients from those that were, and NHS England warned that the need to re-book tests and appointments would mean some disruption from the cyber incident would be felt over coming months³². Third, protect your own devices, because ransomware spreads through the same routes at home. The NCSC advises you to install, update and run antivirus software³³, and notes that paying a ransom carries no guarantee that you will get access to your data or computer, and that your computer or networks will still be infected³⁰. A North Yorkshire risk register notes that in past incidents many organisations had not applied the recommended software updates in a timely manner, which left systems vulnerable²⁵, so keep your own software up to date, including mobile phones³⁴. Our pages on ransomware, antivirus and software updates cover each of these.

Where to get help

Start with your supplier. Your water company is the official source of information during an interruption; check their website for service in your area and whether you can pick up alternative sources of water². Wiltshire and Swindon Prepared advises checking your local water company's website and searching on your postcode to see notifications of what is going on in your area¹⁴. If you do not know who your supplier is, enter your postcode on the Water UK website⁶. Keep the company's emergency supply number to hand, and alert your water company if you identify an issue with the supply¹⁵.

Beyond the supplier, help comes from several directions:

• Local authority: make yourself known to your local authority if you are vulnerable or have additional needs for water, and follow the instructions of the emergency services and your local authority¹⁵.
• Priority Services Register: if you are disabled, chronically sick or of pensionable age, energy suppliers and network operators offer priority support including the password scheme²¹.
• NHS: if a health service is affected, NHS England publishes questions and answers for patients, as it did for Synnovis³², and unaffected hospitals create capacity to take patients from affected ones³². See our guides to NHS services during an IT outage and prescriptions when systems are down.
• Cyber advice: small businesses and individuals can get a free personalised Cyber Action Plan from the National Cyber Security Centre website³⁴.
• Reporting a cyber incident: if your organisation has experienced a cyber incident and is based in the UK, you can report it at gov.uk/report-cyber²⁷.
• Bogus callers: always check the identity of callers to your home and, if in doubt, call the police¹⁹.

For related household problems, our guides to water in an emergency, power cuts, staying informed in an emergency and keeping key records offline cover the practical steps in full.