Southern Water concludes cyber attack investigation and notifies affected customers

Southern Water said on 1 October 2024 that it had concluded its in-depth investigation into data potentially compromised in a cyber attack on its IT systems earlier in the year, and was taking the remaining steps to notify affected customers, employees and former employees¹. The company said the attack resulted in unauthorised access to its systems, that its operations and services to customers were not impacted, and that it was confident its systems are now secure¹.

The company said the number of customers notified of an impact on their data "will remain within the order of 5 to 10 percent of our customer base, as we had announced previously"¹. It said it had appointed a specialist e-discovery partner to interrogate the potentially compromised data, with document types identified by analytics and then manually reviewed to establish whether they contained personal data and, if so, which individuals were concerned¹. It said this process was time-consuming but was followed to identify more precisely what personal data had potentially been compromised¹.

On the data itself, the company said:

Southern Water said it continues to monitor the internet and has found no evidence that the data has been made available online since it was named on the criminals' site on 22 January 2024¹. It said it is very sorry that this has happened and that if it has reason to believe a customer's data may be impacted, it will notify them in line with its regulatory obligations¹.

Affected customers are being offered identity monitoring from Experian, with details and an activation code in the letter sent to them¹. The company said those having problems using the website or signing up can contact Experian on 03444 818182, open 8am to 6pm, Monday to Friday, and that households with more than two people named on their Southern Water account can request additional codes by calling 0330 303 0277, also open 8am to 6pm, Monday to Friday¹. The service includes unlimited access to an Experian Fraud Report, credit alerts, the CreditLock feature, web monitoring for personal information found on the dark web, access to Experian's Victims of Fraud service, and, for those at higher risk of fraud, protective Cifas registration on the credit report¹.

Southern Water advises that individuals create and monitor their own Experian account wherever possible, because an account set up or monitored by someone else, or using another person's email address, can give other people access to the individual's personal data and alerts¹. It says accounts can be created on behalf of someone else, and that Experian will ask for evidence of that person's consent, or of Power of Attorney, Deputyship or similar legal authority where the person cannot give consent¹.

On fraud, the company summarises guidance from the National Cyber Security Centre, the Financial Conduct Authority and the Information Commissioner's Office¹. It advises people to stay alert to suspicious calls, texts and emails, not to hand over information such as bank account details, and instead to hang up or delete worrying messages and then contact their bank to report the suspicious activity¹. It describes phishing as mostly email-based but sometimes by phone, and advises protecting email with a strong password, not sharing passwords, installing the latest security updates, not opening emails from unrecognised senders, checking links look correct before clicking, being suspicious of anyone asking for bank or card details, and treating spelling mistakes in an email as a possible sign of a scam¹.

Why it matters for households

The notification applies to customers of Southern Water, a water and wastewater company, whose household accounts may hold personal data including names, addresses and contact details. The company puts the affected share at 5 to 10 percent of its customer base¹. It says water and wastewater services were not affected by the attack and that its systems are now secure¹. Households that receive a letter are given an activation code for the Experian service and the two contact numbers above for help with sign-up and additional codes¹. The company's own advice on suspicious messages and phishing is set out above and attributed to it¹. The guide to what to do when your details appear in a data breach covers the practical steps households commonly take after a notification, and the guide to when a utility company is hacked explains how water, energy and phone companies handle these incidents. The cyber attacks guide sets out how major IT failures affect household services, and the water incident response guide describes how water companies respond to a major incident.

What happens next

Southern Water says it is taking the remaining steps to notify affected customers, employees and former employees, and that it will notify anyone whose data it has reason to believe may be impacted, in line with its regulatory obligations¹. It says its cyber-security experts are continuing their analysis and further strengthening its security, with enhanced monitoring and protection programmes checking for suspicious activity on its systems¹. No further dates have been reported.