Breachesby GlyphSouth Staffordshire Water
Disclosed May 7, 2026633,887 affectedSettled
Phishing-led cyber attack exposed data of 633,887 people; ICO fine of GBP 963,900
A phishing email in September 2020 let an attacker plant malware that went undetected for 20 months, then seize domain admin rights in May 2022 and exfiltrate data later published on the dark web. The ICO fined the water company GBP 963,900 in a voluntary settlement.
What is known
| People affected | 633,887 (as reported by the organization) |
|---|---|
| Disclosed | May 7, 2026 |
| Discovered | Jul 15, 2022 |
| Attack | Phishing |
| Data exposed | NamesAddressesFinancialEmploymentOther |
| Sector | Energy · GB |
| Status | Settled |
| Lawsuit or fine | GBP 963,900 ICO fine (May 2026) (about $1.3M) |
Sources
Notices filed
History of this record
First recordedby seedSource
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.