South Staffs Water: Cyber-attack

South Staffordshire PLC, the parent company of South Staffs Water and Cambridge Water, experienced a criminal cyber-attack resulting in theft of data from its IT systems. The incident affected over 249,000 customers who have seen their personal contact and banking details available on the dark web. Customers only recently became aware of the scale of damage. Marco Longhi highlights that the company's initial response was inadequate and user-unfriendly, especially for elderly residents with little or no access to IT or those receiving care support in independent settings.

Morton agrees that there are concerns about the time it took between discovering the issue and informing customers. She hopes South Staffordshire will reassure its customers that they take data protection seriously and continue to rectify the matter.

Zeichner, a Cambridge Water customer affected by the cyber-attack, suggests that it would have been better if the company had communicated more simply, saying “There is a problem. You can find out more here, but don’t worry, whatever happens, we will sort it out for you.”

Kniveton contacted South Staffs Water on behalf of affected constituents and found that these customers would need to apply for paper copies of their records from three different credit reference agencies and verify their identity first. She agrees this will cause a considerable amount of work, particularly as they may need to do this regularly.

Responded to the debate by thanking the hon. Member for Dudley North and others who brought attention to cyber-resilience in the water sector. He highlighted a recent ransomware attack on South Staffs Water that resulted in data theft but did not affect the water supply. The National Cyber Security Centre provided support, and affected customers received advice and credit monitoring services. South Staffs Water notified the Information Commissioner’s Office (ICO) of the incident within 72 hours. The Government announced new regulations to strengthen security standards and increase reporting of serious cyber-incidents in essential service companies like water suppliers. Paul Scully emphasised that while legislation is important, it is part of a broader national cyber strategy involving various initiatives and investments worth £2.6 billion to ensure the UK’s resilience against cyber-attacks.