Southern Water named on cyber criminals' site

Southern Water has confirmed that data from a limited part of its server estate was stolen and is at risk following an illegal intrusion into its IT systems, the company announced on 12 February 2024. The company said the theft arose from its ongoing investigation into suspicious activity, as detailed in its statement on 23 January 2024, and that it had been named on the cyber criminals' site on 22 January 2024¹.

The company said its initial assessment was that the data at risk relates to some of its customers and current and former employees. Based on forensic investigations that were ongoing at the time, it said it was notifying "in the order of 5 to 10 percent of our customer base" that their personal data had been impacted, and was also notifying all current employees and some former employees¹. In an update in October 2024, the company said the number of customers notified would remain within that same range².

The notifications include security advice, guidance on recommended precautionary steps and details of support offered, which the company said includes enhanced Experian credit monitoring free of charge for 12 months¹. Southern Water said it had been working with Government, its regulators and the National Cyber Security Centre, and had notified the police and the Information Commissioner's Office¹. It said its operations and services to customers had not been impacted¹.

In the October 2024 update, the company said it had concluded its in-depth investigation of the potentially compromised data and was taking any remaining steps to notify affected customers, employees and former employees. It said it was confident that, since it was named on the cyber criminals' site on 22 January 2024, no data linked to the attack had been made available online, and that following its investigation it was confident in the steps taken to ensure its systems are now secure².

Why it matters for households

Households whose data may be affected are those notified directly by Southern Water, within the order of 5 to 10 percent of its customer base, along with all current employees and some former employees¹. The company said that if it has reason to believe a customer's data may be impacted, it will notify them in line with its regulatory obligations¹. The notifications set out security advice and precautionary steps, and the offer of 12 months of Experian credit monitoring, which the company said provides active monitoring that can detect and help prevent fraudulent misuse of personal information¹. The October update said those accepting the offer would find details in the letter they received, including an activation code, and gave an Experian contact number, 03444 818182, open 8am to 6pm Monday to Friday, and a Southern Water team number, 0330 303 0277, on the same hours, for additional codes where more than two people are named on an account².

The company's published fraud guidance, drawn from the National Cyber Security Centre, the Financial Conduct Authority and the Information Commissioner's Office, advises people to stay alert to suspicious calls, texts and emails, not to hand over information such as bank account details, and instead to hang up or delete worrying messages and then contact their bank to report the suspicious activity. It describes phishing as mostly email-based but also possible over the phone, and advises protecting email with a strong password, not sharing passwords, installing the latest security updates, not opening emails from unrecognised senders if in doubt, checking links before clicking, and treating spelling mistakes in an email as a possible sign of a phishing scam². Southern Water also advises that, wherever possible, individuals create and monitor their own Experian services account, and sets out what Experian will ask for where someone manages an account on another person's behalf, including evidence of consent or of Power of Attorney, Deputyship or similar legal authority².

For general guidance on what to do when a utility company is hacked, see When Your Water, Energy or Phone Company Is Hacked, part of the cyber-attacks hub.

What happens next

Southern Water said further updates would be posted on its website and social media channels as it knew more¹. It said its cybersecurity experts were continuing their analysis and further strengthening its security, and that it was using enhanced monitoring and protection programmes to check continually for suspicious activity on its systems².