Water firm fined after customers' details hacked

Water firm fined after customers' details hacked3 hours agoShareSaveAdd as preferred on GoogleOprah FlashWest MidlandsBBCThe hack went undetected by the firm for 20 months, regulators foundA water company has been fined after hundreds of thousands of customers had their personal data hacked.South Staffordshire, made up of South Staffordshire Plc and South Staffordshire Water Plc, was ordered to pay £963,900 by the Information Commissioner's Office (ICO) following the cyber attack, traced back to September 2020.The firm supplies south Staffordshire, Walsall, Dudley, north Warwickshire, north Worcester and south Derbyshire.Personal information of 633,887 people was taken and published on the dark web in the attack, which largely took place between May and July 2022, the ICO found.The watchdog and water company agreed a voluntary settlement and South Staffordshire made an early admission of liability, agreeing to pay the penalty without appeal.A phishing email was used to launch the hack which allowed the cyber attackers to install malicious software and it remained undetected within the organisation's systems for 20 months.In May 2022, the hacker went through the firm's network and took over administrator privileges — the highest level of system access to the IT network, the ICO said.Ransom noteThe breach came to light when IT performance issues prompted an internal investigation on 15 July 2022.The company reported a personal data breach a few days later before, on 26 July 2022, South Staffordshire found a ransom note that the hacker had unsuccessfully attempted to send to certain members of staff.Between August and November 2022, South Staffordshire discovered more than 4.1 terabytes (TB, each equal to 1,000GB) of data were published on the dark web.They included bank details of customers and National Insurance numbers of staff.The ICO's investigation found South Staffordshire failed to bring in adequate security controls under UK data prote...