A cyber attack has leaked the data of thousands of Southern Water customers in the South East of England.
In early 2024, Southern Water revealed that some of its data had been breached. The security violation happened following an “illegal intrusion” into the company’s IT systems. In other words, a cyber-attack resulting in a personal data breach for some customers and employees.
A statement from Southern Water states that:
The following customer information is believed to have been accessed by cybercriminals:
Employee and past employee data may also have been compromised, including:
This personal and financial information may have been stolen for sale on the dark web.
Our data protection lawyers have launched a claim against Southern Water. We believe poor security processes at Southern Water led to this data breach, and we are seeking justice for the customers and employees who were affected.
“Data breach claims play an important role in holding organisations accountable when personal information is not adequately protected. Our team combines data protection expertise with experience of complex group actions to investigate breaches and pursue appropriate remedies.”
Kingsley Hayes | Partner & Head of Data & Privacy Litigation
Southern Water released a statement confirming that it had experienced a cyber incident.
Southern Water announced that data had been stolen and was at risk following an illegal intrusion into its IT systems.
At KP Law, we represent clients in group actions with the innovation, resources and expertise needed to take on complex cases. Our GDPR, data breach and cybercrime specialists have more than 50 years of combined experience, making us one of the most experienced multi-claimant law firms in the UK. Working alongside leading barristers and legal experts, we provide the highest standard of support while leveraging the resources and global expertise required to pursue challenging claims successfully. With offices in London, Liverpool, Manchester and Birmingham, supported by technology that enables us to serve clients across England and Wales, we combine national reach with a modern, client-focused approach. By using innovative technology, operating on a no-win, no-fee basis, and keeping the process straightforward and hassle-free, we make accessing expert legal representation as simple as possible.
While each case is judged on its own merits, there are some things we would typically look for when it comes to when claiming compensation following a data breach, cybercrime or other GDPR violation:
With stolen data, cybercriminals can make purchases using your bank and credit cards, apply for credit in your name, set up fraudulent bank accounts and access your existing online accounts.
GDPR failures, cybercrime and data breaches can have a significant impact on you, both mentally and physically. They can cause or exacerbate anxiety, stress and other psychological conditions.
Your data has value, and organisations must be held to account if they fail to protect your right to data privacy or otherwise do not uphold your GDPR rights.
The security violation happened following an “illegal intrusion” into the company’s IT systems. In other words, a cyber-attack.
It’s difficult to know exactly because it depends how well the cyber attack was carried out and whether they were able to cover up their tracks for a longer period of time before being discovered. However, Southern Water will have been bound by certain rules which states that:
Organisations must report a data breach to the Information Commissioner’s Office (ICO) within 72 hours of discovery under the Data Protection Act 2018. That means Southern Water will have acted quickly to satisfy this requirement, as failure t comply with the data protection law can lead to substantial fines from the ICO.
The following information is believed to have been accessed by cybercriminals:
Employee and past employee data may also have been compromised, such as:
This personal and financial information may have been stolen for sale on the dark web.
A statement from Southern Water says:
“On Monday 12 February 2024 we announced that data from a limited part of Southern Water’s server estate had been stolen and was at risk following an illegal intrusion into our IT systems. This arose from our ongoing investigation into suspicious activity, as detailed in our statement on 23 January 2024.
We are very sorry that this has happened.
We continue to work with our expert technical advisers to confirm whose data is at risk. Our initial assessment is that this is the case for some of our customers and current and former employees.
We have engaged leading independent cybersecurity experts to monitor the “dark web”. They continue to report to us that, since we were named on the cyber criminals’ site on 22 January 2024, they have found no new evidence of the data potentially involved in this cyber incident being published online. They will continue to carry out their checks for as long as is necessary.
We take data protection and information security very seriously and, in accordance with our regulatory obligations, we are making contact with anyone whose personal data may be at risk.
Based on our forensic investigations so far, which are ongoing, we are notifying in the order of 5 to 10 percent of our customer base to let them know that their personal data has been impacted. We are also notifying all of our current employees and some former employees.
These notifications include security advice, as well as guidance on recommended precautionary steps and details of the support we are offering them. This support includes enhanced Experian credit monitoring, free of charge, for the next 12 months. The service provides active monitoring which can detect and help prevent fraudulent misuse of personal information.
Throughout this process we have been working with Government, our regulators and the National Cyber Security Centre. We have also notified the police and the Information Commissioner’s Office.
Since the incident, our IT security teams have worked with independent incident response experts, using enhanced monitoring and protection tools to check actively for any suspicious activity on our IT estate. Southern Water’s operations and services to customers have not been impacted.
Further updates will be posted on our website and social media channels as we know more. Please be assured that if at any point we have reason to believe your data may be impacted, we will notify you, in line with our regulatory obligations.
If you have specific questions relating to the cyber incident then please call 0330 303 0025.”
Southern Water should be in touch to notify affected individuals.
Anyone who thinks they might be involved should take immediate steps to protect themselves. Find out how to do this here.
If you receive notification that you are affected by the data breach, register to receive updates on our investigation. We’ll let you know what’s happening, and if and when you can make a no-win, no-fee data breach compensation claim.
A group action claim is where a group of people – sometimes even thousands of people – have been affected by the same issue. Group action cases are also known as class actions, multi-claimant, or multi-party actions.
If we do launch a group action, there are no costs to join a claim. However, if your claim is successful, you may have to pay a ‘success fee’. This fee is taken from the compensation awarded to you. At KP Law, our success fee is competitive, and we make sure you are fully informed about any potential costs before you officially join our action. If you lose, you won’t have to pay a penny.
You may be concerned that your data was put at risk in the Southern Water data breach. Under the data protection act 2018 individuals have the right to know how their data is being processed and used, what information a company has about them, and they can request to have their data deleted under the data protection act.
“Used KP Law for a group data breach compensation claim. I was kept updated throughout the process. The whole thing was easy with no stress.” – Anon
“I used the firm as part of a group action following a, potentially, hazardous data breach. From the very start, I was kept updated regarding the other side’s actions and what the counter actions were. I found KP to be trustworthy, knowledgeable and very customer friendly.” – Pat
“I used KP Law for the first time for a data breach group compensation claim. From outset to conclusion I was kept fully informed and received clear, regular updates throughout. I would not hesitate to recommend them and would choose them in any future action.” – Owen
By not putting adequate processes and training in place, organisations are leaving customers open to an increased risk of cyber scams and avoidable mistakes that lead to data breaches. If you are a victim of a data protection failure, check out our current group actions below to see if we are running a claim related to that specific breach.
Unsure if your personal data has been exposed in a breach? Learn how to check and what steps to take, including your right to join a group claim in the UK.
At KP Law, our expert data breach lawyers want to lessen the impact of a data violation as much as possible. To help, we have collated a range of support, information and other resources to help you get your life back on track.
The Court of Appeal has handed down its judgment in Farley v Paymaster, a landmark decision which strengthens the rights of data breach victims
In today’s digital world, personal data has become one of the most valuable commodities—especially for cybercriminals. From financial details to personal information and even login credentials, hackers actively seek out this information to commit fraud, identity theft, and other illegal activities. Stolen data is bought and sold on the dark
In today’s digital landscape, safeguarding personal information is more critical than ever. A data breach occurs when unauthorised individuals gain access to confidential data, leading to potential misuse of sensitive information. This can result in identity theft, financial loss, and a breach of privacy. What is a Data Breach? A
