South Staffs Water and Cambridge Water data hack: what to do if you're affected

South Staffs Water and Cambridge Water customers may have had their personal data stolen by fraudsters as a result of a targeted cyber attack.

South Staffordshire PLC, the parent company of both suppliers, serves more than 1.7 million people. It is currently informing affected customers about the attack, which took place in mid August.

Here, we explain what the breach means for customers, and what to do if your details have been compromised.

How are affected customers being protected?

South Staffordshire PLC has issued an apology for the cyber attack on 16 August, and has assured customers that their water supply hasn't been affected.

It has written to those who may have had their data stolen, and will give them free access to a credit monitoring service for a year.

This service will alert customers if someone attempts to fraudulently apply for financial products in their name.

South Staffordshire PLC is also setting up a dedicated helpline for victims of the hack.

What data has potentially been stolen?

South Staffordshire PLC says it is 'still assessing the potential impact on customer data' and is liaising with the National Crime Agency.

There are concerns that customers may have had their personal data, including names, addresses, sort codes and bank account numbers leaked on the dark web. 

This kind of personal information can be used by fraudsters to steal your identity and commit fraud by buying products or subscriptions in your name, or applying for loans and credit cards.

Leaked data can also be used to scam you in the future. For example, fraudsters can use your information to convince you they’re someone that they’re not, or to claim benefits in your name.

What to do if your data has been stolen

If you find that you've been the victim of identity theft or fraud, contact your bank immediately. You should also speak to your local police department and report the crime to Action Fraud.

If you’re a South Staffs Water or Cambridge Water customer, you should be extra vigilant about unexpected calls, emails and texts purporting to be from companies, as these could be sophisticated scams from fraudsters utilising your stolen data.

What are your rights in the event of a data breach?

Under the Data Protection Act 2018 (GDPR), a company must inform you swiftly if you have been the victim of a data breach. You should expect to be given the name and contact details of its data protection officer, an outline of planned and proposed measures and the likely outcomes of the data breach.

If the data breach causes you financial loss, damage or distress, you may be able to make a claim for compensation. First, you can complain to the company using its complaint procedure, and then escalate the case to the small claims court if you're unhappy with the outcome.

It may also be helpful to complain about the breach to the Information Commissioner’s Office (ICO). The ICO can’t offer compensation, but can give an opinion as to whether an organisation has compromised your data.