South Staffordshire Water
Disclosed May 7, 20264 months ago633,887 affectedSettled
Phishing-led cyber attack exposed data of 633,887 people; ICO fine of GBP 963,900
A phishing email in September 2020 let an attacker plant malware that went undetected for 20 months, then seize domain admin rights in May 2022 and exfiltrate data later published on the dark web. The ICO fined the water company GBP 963,900 in a voluntary settlement.
What is known
| People affected | 633,887 (as reported by the organization) |
|---|---|
| Disclosed | May 7, 2026 |
| Discovered | Jul 15, 2022 |
| Attack | Phishing |
| Data exposed | Names, Addresses, Financial, Employment, Other |
| Sector | Energy · GB |
| Status | Settled |
| Lawsuit or fine | GBP 963,900 ICO fine (May 2026) (about $1.3M) |
Sources
| Source | |
|---|---|
| Fine of nearly GBP 1m issued against South Staffordshireico.org.uk · Regulator | Regulator |
| ICO: South Staffordshire Plc and South Staffordshire Water Plcico.org.uk · Regulator | Regulator |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | May 7 | 633,887 |
History of this record
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.