Over 630,000 customers and employees had their data leaked onto the dark web – and the company has since been fined nearly £1 million
The owners of a Cambridge water company have been fined nearly £1 million after thousands of customers and employees had their data leaked. The Information Commissioner’s Office (ICO) has fined South Cambridgeshire Staffordshire Plc £963,900.
The company owns Cambridge Water. The fine follows a serious cyber attack that led to the information of 633,887 customers and employees, including those in the Cambridge Water area, having their data leaked on the dark web.
In its Monetary Penalty Notice, the ICO confirmed the cyber attack traced back to September 2020. It mostly took place between May and July 2022.
Elena Karpathakis, managing director at Cambridge Water said: “We are sorry for the worry and disruption this cyber attack caused. We know that customers place their trust in us to protect their information. As soon as we became aware, we worked to contain the cyber attack, support those affected and put additional protections in place.
“Since 2022, we have continued to invest significantly in our cyber security, including strengthening governance and monitoring, and we will continue this focus as threats continue to evolve. We remain focused on doing the right thing for our customers and learning from what happened.”
The cyber attack on South Staffordshire Water began with a phishing email. The recipient of the email opened an attachment which allowed the scammer to install software onto the company’s system.
This remained undetected for nearly two years. In May 2022, the hacker then moved through the IT network. The breach was identified in July 2022 when IT issues prompted an internal investigation.
The company discovered a ransom note that the hacker had unsuccessfully tried to send to members of staff. Between August and November 2022, the company detected that more than 4.1 terabytes of stolen data had been released on the dark web.
This included: personal details including full name and email addresses, HR information from employees, and customer account information. The ICO investigation found South Staffordshire failed to implement a range of UK controls.
These included:
- Inadequate controls that led to the hacker being able to escalate to administrator privileges;
- Inadequate monitoring and logging;
- Use of obsolete and unsupported software on some devices;
- Inadequate vulnerability management, including unpatched critical systems and the absence of regular internal or external security scans.
Law firm Leigh Day is now representing around 6,500 people impacted by the data breach. Sean Humber, Leigh Day partner and group claims data breach specialist, said: “This significant fine recognises South Staffordshire’s serious failures that resulted in the personal information of hundreds of thousands of its own customers being stolen, leaving them at a huge risk of being targeted by fraudsters.”
Gene Matthews, Leigh Day partner and group claims data breach specialist, added: “Those personally affected by the data breach are likely to have strong claims for compensation for the distress caused by the breach, as well as any financial losses suffered.
“While the amounts are likely to vary from individual to individual, given the sensitivity of the information, many of the claims for compensation are likely to be substantial.”
You must be logged in to post a comment Login