South Staffordshire Water targeted by ransomware actors during drought

South Staffordshire Water was targeted by ransomware actors who claimed to have accessed systems controlling industrial processes at the company's water treatment plants, according to a House of Commons committee report on ransomware and national security published on 13 December 2023¹. The attack is recorded as having taken place in August 2022, a period when much of England was under drought conditions¹.

The report, by the Joint Committee on the National Security Strategy, sets the incident among a series of attacks on UK organisations. It records that the Advanced software provider, which supports NHS 111 and other patient systems, "also found itself under attack in August 2022"¹. It also states that Royal Mail found its export services "paralysed for weeks" after a ransomware attack in January 2022, and that the Lockbit ransomware group had released data from the Ministry of Defence after an attack on a metal fencing company, Zaun¹.

The committee describes ransomware as identified by the Government as the UK's foremost cyber security risk¹. It cites an assessment by one cyber security firm that the number of attacks against UK victims increased by 233% between 2020 and 2021, and that the volume of ransom payments quadrupled over the same period¹. On the nature of the threat, the report states:

The report gives earlier examples of the disruption such attacks cause. It records that Redcar and Cleveland Borough Council suffered a "catastrophic" ransomware attack in February 2020, that its recovery took eight and a half months, and that the Council refused to pay the ransom, in part to protect other local authorities from similar attacks¹. It states that Hackney Council experienced a major ransomware attack in October 2020 which disrupted council services for months and cost the Council over £12 million, and that Gloucester City Council faced costs of around £800,000 after its systems were infected by malware from a Russian threat actor in December 2021, causing delays to benefits payments, property sales and planning applications¹. The WannaCry attack in 2017 affected over 200,000 computers in more than 150 countries, affected at least 34% of trusts in England, and was estimated to have cost the health service around £92 million through lost services¹.

The report does not state what systems at South Staffordshire Water were affected beyond the actors' claim, whether supply to households was interrupted, or how long any disruption lasted. Those details have not been reported in the document.

Why it matters for households

The report describes members of the public as secondary victims of ransomware, blocked from accessing vital services, or finding their sensitive data shared online¹. For households, an attack on a water company raises the possibility of interruption to supply or to the treatment and testing that keeps tap water safe, although no such interruption is recorded for this incident in the report. The committee's wider finding is that ransomware is the Government's foremost cyber security risk to the UK, and that attacks on local authorities have stopped councils processing benefits, property sales and planning applications for weeks or months¹. The report does not set out advice to households on preparing for utility cyber attacks.

What happens next

The report was published on 13 December 2023 as the first report of session 2023 to 24, with recommendations to government; the Government has two months to respond¹. The committee held a private roundtable with representatives of seven organisations that had experienced ransomware attacks in May 2023¹. On 4 December the Government confirmed its commitment to provide "up to £10 million of new funding for research on risks to the economy and our public finances"¹.

For practical guidance, see when your water, energy or phone company is hacked, ransomware: what it is and how it affects households, the cyber-attacks hub, and the National Cyber Security Centre: help for individuals and families.