South Staffordshire Water data breach compensation

In 2022, hackers accessed South Staffordshire Water’s systems after a 20-month undetected breach, publishing the personal and financial data of 633,887 UK customers and employees on the dark web.

The attack started with a phishing email, a scam message designed to trick the recipient into opening an attachment. This allowed the attacker to install malicious software which went undetected inside South Staffordshire’s systems for 20 months. By May 2022, the hacker had gained the highest level of access to the company’s IT network and was able to move freely through it.

The breach only came to light when the company noticed IT performance issues and launched an internal investigation in July 2022. Shortly afterwards, South Staffordshire discovered a ransom note the hacker had tried to send to staff. By November 2022, more than 4.1 terabytes of stolen data had been published on the dark web.

The ICO found that South Staffordshire had left the door open to attackers. Only 5% of its IT systems were being monitored, outdated software was still in use and basic security checks were not being carried out. South Staffordshire admitted liability and agreed to pay the fine without appeal. The ICO applied a 40% reduction for the early admission, bringing the final penalty to £963,900.

Ian Hulme, ICO Interim Executive Director for Regulatory Supervision, said: “Customers do not have the choice over which water company serves them – they are required to share their personal information and place their trust in that provider. Waiting for performance issues or a ransom note to discover a breach is not acceptable. Proactive security is a legal requirement, not an optional extra.”

What are your rights?

South Staffordshire had a legal obligation to protect your personal data. The ICO has confirmed that the company failed to implement appropriate security controls required under UK data protection law – a failure that left customers and employees vulnerable for nearly two years and resulted in highly sensitive personal and financial data being published on the dark web.

The ICO’s fine of £963,900 confirms that South Staffordshire breached its legal obligations. Affected individuals have the right to seek compensation, including where no direct financial loss has occurred. Distress, anxiety and loss of control over your personal data are all recognised as grounds for a claim under UK data protection law.

What data breach compensation could you receive?

There is no fixed amount. Each case is assessed on its own merits. Factors that are likely to be relevant include:

• Type of data exposed. The breach involved full names, physical addresses, email addresses, dates of birth, gender and telephone numbers. For customers, it also included online account usernames and passwords and bank account numbers and sort codes. For employees, it included national insurance numbers. For a small percentage of customers on the Priority Services Register, information from which disabilities could be inferred was also included. This is among the most serious combinations of personal and financial data that can be exposed.
• Bank account details. The exposure of bank account numbers and sort codes creates a direct and serious risk of financial fraud. This is one of the most significant factors relevant to the value of a claim.
• The ICO fine. The ICO’s finding that South Staffordshire failed in its legal obligations – and its decision to impose a fine of nearly £1 million – confirms the seriousness of the breach and is directly relevant to individual compensation claims.
• Length of time undetected. The malicious software remained undetected for 20 months. During that time affected individuals were unable to take any steps to protect themselves. This prolonged exposure is relevant to the value of a claim.
• Distress and anxiety. Knowing that your bank details, personal information and in some cases disability-related data has been stolen and published on the dark web causes real and lasting harm. Stress, worry and loss of trust are all recognised as non-material harm that can support a compensation claim.
• Financial loss. If you have experienced any suspicious activity, unauthorised transactions or financial loss that can be linked to the breach, this would significantly strengthen a claim.
• Priority Services Register customers. If you were registered on the Priority Services Register at the time, information from which disabilities could be inferred was included in the exposed data. This is an especially sensitive category of personal information and is likely to be relevant to the value of a claim.

Frequently asked questions