South Staffordshire Water Fined £1m After Data Breach

A UK water company has been fined nearly £1m ($1.4m) by the data protection regulator after a two-year-long incident resulted in the compromise of personal information on over 633,000 people.

South Staffordshire Water and parent company South Staffordshire PLC agreed to pay the Information Commissioner’s Office (ICO) a fine 40% lower than the original £1.6m ($2.2m) sum in return for not contesting the fine.

The incident itself began with a successful phishing email on September 11, 2020 which resulted in the installation of the Get2 downloader and the SDBbot remote access Trojan (RAT).

However, the network intrusion went undetected for nearly two years. On May 17, 2022 the threat actor began moving laterally through the water company’s network, using a domain administrator account and the remote desktop protocol to access 20 different endpoints between that date and August 4.

The breach was only discovered when IT performance issues – caused by “unscheduled database exports” – prompted an investigation on July 15, 2022. Nine days later the company reported a personal data breach to the regulator.

On July 26, the water company discovered a ransom note that the threat actor had unsuccessfully tried to send to some members of staff.

The threat actor claimed to have stolen 4.1TB of data from South Staffordshire Water, amounting to 633,887 current and former customers and employees. That’s around a third (34%) of all the personal information held by the company, according to the ICO.

The stolen PII, which was dumped on the dark web, was highly sensitive, including:

The company’s security posture was found wanting on several fronts:

Ian Hulme, ICO interim executive director for regulatory supervision, argued that water customers don’t have a choice as to which company they use, meaning providers must take data protection responsibilities seriously.

"The steps that South Staffordshire failed to take are established, widely understood and effective controls to protect computer networks. The ICO expects all organizations – and particularly those handling large volumes of personal information as part of critical national infrastructure – to have these in place,” he added.

“Waiting for performance issues or a ransom note to discover a breach is not acceptable. Proactive security is a legal requirement, not an optional extra."

The ICO published a lengthy write up of the case, which could be useful for security professionals working in this and other critical infrastructure sectors.

The regulator urged organizations to review their own resilience posture in light of the incident, and ask themselves the following: