U.K.-based water utility Southern Water has confirmed that hackers stole the personal data of as many as 470,000 customers in a recent data breach. The company plans to notify “5 to 10 percent” of its customer base that their personal information was compromised during a cyberattack in January. This breach has affected a significant number of individuals and raises concerns about data security and privacy.
Key Takeaway
Southern Water, a major U.K. utility provider, has confirmed a significant data breach, affecting a large number of customers and potentially exposing sensitive personal information. The breach underscores the importance of robust cybersecurity measures and the need for organizations to prioritize the protection of customer and employee data.
Extent of the Breach
Southern Water, which provides water and wastewater services to millions of people across the South East of England, has not disclosed the exact number of individuals affected. However, based on its ongoing forensic investigations, the actual number of individuals affected could be higher than the initial estimate. The breach has potentially exposed sensitive personal information, including dates of birth, national insurance numbers, bank account details, and reference numbers of the affected customers.
Impact on Employees
In addition to its customers, Southern Water also plans to notify all current and some former employees about the breach of their personal information. This incident has raised concerns about the security of employee data, considering the company’s approximately 6,000 employees.
Perpetrators and Response
The cyberattack on Southern Water was claimed by the Black Basta ransomware group, a Russia-linked gang known for previous cyber incidents. The group threatened to publish the stolen data unless a ransom demand was paid. While the specifics of the incident and how the systems were compromised remain undisclosed, Southern Water is working with cybersecurity experts to monitor the dark web for any potential data leaks. The company has also notified the U.K.’s data protection regulator, the Information Commissioner’s Office, about the breach.
