"Waiting for performance issues or a ransom note to discover a breach is not acceptable. Proactive security is a legal requirement, not an optional extra." — Ian Hulme, ICO interim executive director for regulatory supervision.
Scale and settlement: a nearly £1m fine for South Staffordshire Water
South Staffordshire Water and its parent, South Staffordshire PLC, agreed to pay the Information Commissioner’s Office (ICO) a fine described as nearly £1m (about $1.4m) after a breach that exposed the personal information of 633,887 current and former customers and employees. The agreed payment was 40% lower than an original £1.6m ($2.2m) penalty, in return for not contesting the fine.
The intrusion: how the attacker got in and lingered
The breach began with a successful phishing email on 11 September 2020 that installed the Get2 downloader and the SDBbot remote access Trojan (RAT). The attacker’s presence went undetected for almost two years. On 17 May 2022 the threat actor began moving laterally across the company’s network, leveraging a domain administrator account and the remote desktop protocol (RDP) to access 20 different endpoints between 17 May and 4 August 2022.
The breach was discovered only after IT performance issues—traced to “unscheduled database exports”—prompted an investigation on 15 July 2022. Nine days later the company notified the ICO of a personal data breach. On 26 July the water company found a ransom note that the attacker had unsuccessfully attempted to send to some staff, and the threat actor claimed to have stolen 4.1TB of data, which was subsequently dumped on the dark web.
What was taken: detailed, sensitive personal information
- The ICO recorded the theft of 4.1TB of data affecting 633,887 individuals — about 34% of the company’s personal information holdings, according to the regulator.
- Exposed data included full name, physical and email addresses, dates of birth, gender and telephone numbers.
- Employee HR records were taken, including National Insurance numbers.
- Customer account information and bank account numbers with sort codes were among the files stolen.
- Information on customers registered on the Priority Services Register — from which disabilities could be inferred — was also included in the data set.
Security failings the ICO identified
- Limited access controls: the ICO found a lack of least-privilege enforcement, allowing the attacker to escalate to administrator privileges.
- Insufficient monitoring and logging: just 5% of the IT environment was being monitored, according to the regulator.
- Use of legacy, unsupported software on some devices, explicitly including Windows Server 2003.
- Inadequate vulnerability management: critical systems were unpatched and there were no regular internal or external security scans.
What this means for technologists, regulators, and customers
- Technologists and security teams: the ICO’s assessment highlights the operational gaps that enabled privilege escalation and extended dwell time — namely, least-privilege enforcement, comprehensive logging and monitoring coverage, and routine vulnerability scanning. The regulator also spelled out the need to eliminate unsupported software.
- Regulators and procurement leaders: the case underscores the ICO’s expectation that organizations handling large volumes of personal data as part of critical national infrastructure must implement established controls. The ICO has published a lengthy write-up and urged organizations to review resilience in light of the incident.
- Customers and employees whose data was exposed: the breach included highly sensitive identifiers and banking details, plus Priority Services Register information from which disabilities could be inferred. The public-facing consequence was the dumping of stolen data to the dark web and the claim—made by the attacker—that 4.1TB had been taken.
The ICO distilled practical questions for other organizations from this case: are least-privilege controls enforced; do logging and monitoring cover the environment and produce actionable alerts; are systems patched and supported; and is vulnerability management practiced regularly, with internal and external scanning?
The penalty, the technical trail of the intrusion, and the catalogue of exposed personal information form a concrete record that the ICO has used to both sanction and educate. The regulator’s message is unambiguous: for companies entrusted with critical data, passive discovery—via performance issues or ransom notes—is inadequate. The record now sits as a detailed example for other utilities and data controllers to review and learn from.
Original reporting: https://www.infosecurity-magazine.com/news/south-staffordshire-water-fined-1m/
