Southern Water confirms customer data stolen in cyber attack

Southern Water announced on Monday 12 February 2024 that data from a limited part of its server estate had been stolen and was at risk following an illegal intrusion into its IT systems¹. The company said the finding arose from its ongoing investigation into suspicious activity, as detailed in its statement on 23 January 2024¹.

The company said its initial assessment is that personal data is at risk for some customers and current and former employees¹. Based on forensic investigations that are ongoing, it is notifying in the order of 5 to 10 per cent of its customer base, and is also notifying all current employees and some former employees¹. The notifications include security advice, guidance on recommended precautionary steps and details of support, which includes enhanced Experian credit monitoring free of charge for the next 12 months¹.

Southern Water said independent cybersecurity experts engaged to monitor the dark web continue to report that, since the company was named on the cyber criminals' site on 22 January 2024, they have found no new evidence of the data potentially involved being published online¹. The company said it has been working with Government, its regulators and the National Cyber Security Centre, and has notified the police and the Information Commissioner's Office¹. It said its operations and services to customers have not been impacted¹.

Why it matters for households

Households in Southern Water's supply area are affected only if they are among the customers the company is contacting; the company has not published a list of affected areas or accounts, and has said it will notify anyone whose data may be impacted in line with its regulatory obligations¹. The company states that water operations and services to customers have not been affected¹. Those notified are being given security advice and precautionary steps by the company, together with 12 months of Experian credit monitoring at no charge¹. The company has not reported which categories of personal data were involved. Households can check whether their email address appears in a known breach using the guide on how to check if your email was in a breach, and the guide to when your water, energy or phone company is hacked sets out how these incidents are handled. The cyber attacks and major IT failures guide and the water incident response guide cover the wider context.

What happens next

Southern Water said further updates will be posted on its website and social media channels as it knows more, and that it will notify anyone whose data may be impacted¹. Its forensic investigations are ongoing¹. No further dates have been reported.