Southern Water data breach

On 22 January 2024, Southern Water discovered a cybercriminal claim that data had been stolen from its IT systems. On 12 February 2024, it confirmed that data from a limited part of its servers had been compromised following an illegal intrusion.

Southern Water worked with independent cybersecurity experts to investigate the breach. Following an in-depth investigation, the company confirmed that some customer data and current and former employee data had potentially been compromised. 

The number of customers notified of an impact on their data remained within the order of 5 to 10 percent of Southern Water’s customer base. All current employees and some former employees were also notified.

The data potentially compromised includes basic personal details used for administering customer accounts, such as names and contact details. It may also include national insurance numbers and dates of birth for customers who had provided these details to Southern Water.

Southern Water has confirmed that since being named on the cyber criminals’ site on 22 January 2024, its independent dark web monitoring experts have found no evidence of the data potentially involved in the incident being published online. The company’s operations and services to customers have not been impacted and water supplies were not affected.

Throughout the process, Southern Water worked with the government, its regulators and the National Cyber Security Centre. The incident was reported to the police and the Information Commissioner’s Office.

What are your rights?

Southern Water had a legal obligation to protect your personal data. An illegal intrusion into its IT systems resulting in the theft of customer and employee data represents a failure of that obligation, and affected individuals have the right to seek compensation –  including where no direct financial loss has occurred.

Distress, anxiety and loss of control over your personal data are all recognised as grounds for a claim under UK data protection law. The inclusion of national insurance numbers and dates of birth in the potentially compromised data makes this a particularly serious breach, as this type of information can be used to facilitate identity fraud.

What data breach compensation could you receive?

There is no fixed amount. Each case is assessed on its own merits. Factors that are likely to be relevant include:

• Type of data exposed. The potentially compromised data includes names, contact details, national insurance numbers and dates of birth. National insurance numbers in particular are among the most sensitive identifiers held by a utility company and their exposure significantly increases the risk of identity fraud.
• Distress and anxiety. Knowing that your personal data has been stolen by a criminal organisation causes real harm. Stress, worry and loss of trust are all recognised as non-material harm that can support a compensation claim.
• Risk of identity fraud. National insurance numbers and dates of birth combined with names and contact details are precisely the information used to commit identity fraud. Even where no confirmed misuse has occurred, the ongoing risk is relevant to the value of a claim.
• Financial loss. If you have experienced any suspicious activity, fraud or financial loss that can be linked to the breach, this would strengthen a claim further.
• Employees and former employees. If you are a current or former Southern Water employee who was notified of the breach, your employment-related data may have been involved. This is relevant to the nature and value of any claim.

Frequently asked questions