Back Therecord.Media

UK water company allowed hackers to lurk undetected for nearly two years, regulator finds

Therecord.Media • May 11, 2026

The Information Commissioner's Office (ICO) fined South Staffordshire Water £963,900 ($1.3 million) on Monday over an attack by the Cl0p ransomware group that led to the personal data of 633,887 customers and employees being published in August 2022.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

South Staffordshire Water Fined Nearly £1M for Cybersecurity Failures The Information Commissioner's Office (ICO) has fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 due to a serious cyber attack that compromised the personal data of 633,887 individuals. The breach, linked to the Cl0p ransomware group, began with a phishing email in September 2020, allowing malware to remain undetected for 20 months. The hacker escalated privileges within the network by May 2022, leading to the leak of over 4.1 terabytes of data on the dark web. Key failures included inadequate monitoring, unpatched critical systems, and the use of unsupported software such as Windows Server 2003. The ICO's investigation revealed that South Staffordshire did not implement necessary security controls as mandated by UK data protection law. The fine reflects the severity of the breach and the company's lack of proactive security measures. Following the incident, South Staffordshire has made improvements to its cybersecurity posture. 22 sources 69

Extracted Entities

UK water company allowed hackers to lurk undetected for nearly two years, regulator finds

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Ransomware Groups (1)