Cybersecurity Policy Report, Water Company Fined in U.K. Over Data Security Lapses, (May 12, 2026)

By Tony Foley

A regulated water company has been fined 963,900 pounds sterling ($1.3 million) by the United Kingdom’s Information Commissioner’s Office (ICO) after its failure to implement appropriate security measures led to a cyber attack that exposed the personal information of thousands of customers.

Background. South Staffordshire plc is an integrated services group that operates South Staffordshire Water plc, a regulated water company that supplies water to 1.6 million people. In a news release yesterday announcing the fine, ICO said the company suffered a cyber attack that began with a successful phishing attempt in September 2020. The attackers installed malicious software that remained undetected in the company’s system for 20 months.

South Staffordshire identified the breach only after technical issues prompted an internal investigation in July 2022, after which the company reported a data breach to ICO. Two days after reporting the breach, South Staffordshire discovered a ransom note that the attacker had unsuccessfully attempted to distribute to company staff members, and between August and November 2022, it detected the publishing of more than 4.1 terabytes of data on the dark web.

The breach resulted in the disclosure of the personal data of 633,387 people, including full names, addresses, e-mails, dates of birth, phone numbers, employee data, customer account information, and for a small percentage of customers, disability information.

ICO findings. The ICO found that South Staffordshire failed to implement appropriate security controls as required under U.K. data protection law, including inadequate controls that allowed the attacker to escalate to administrator privileges, inadequate monitoring and logging, use of obsolete and unsupported software on some servers, and inadequate vulnerability management.

"The steps that South Staffordshire failed to take are established, widely understood and effective controls to protect computer networks,” said Ian Hulme, ICO’s interim executive director–regulatory supervision. “The ICO expects all organisations—and particularly those handling large volumes of personal information as part of critical national infrastructure—to have these in place. Waiting for performance issues or a ransom note to discover a breach is not acceptable. Proactive security is a legal requirement, not an optional extra.”

Mitigation efforts. ICO informed South Staffordshire in December 2025 that it intended to levy a fine, after which the company submitted representations regarding improvements made after the attack, support offered to affected individuals, and engagement with other regulators, including the National Cyber Security Centre. After reviewing the company’s representations, ICO said the parties reached a voluntary settlement. In its monetary penalty notice, ICO acknowledged that South Staffordshire made an early admission of liability and agreed to pay a penalty without appeal. The fine amount reflects a 40% reduction recognizing the efficiencies that the early admission brought to the investigation.

News: InternationalLegislation LitigationEnforcement DataSecurity DataBreach