Legal firm says cyber attack on water firm could lead to “substantial claims for compensation”

A legal firm says “substantial claims for compensation” are likely to be made after hackers accessed personal details of a water company’s customers.

Households across Lichfield and Burntwood have received letters in recent weeks confirming their data may have been published online following the incident which saw IT systems at South Staffs Water and Cambridge Water targeted in August.

The information is believed to relate to customers who pay via direct debit.

Ransomware group C10p claimed responsibility for the attack, saying they had taken over five terabytes of data from the company’s system which were then published to an area of the internet known as the darkweb.

The hackers posted screenshots of identification documents as well as details of systems used to monitor and control water treatment.

Sean Humber, a data breach specialist and partner at legal firm Leigh Day, said:

“This is a large and serious data breach. As the water companies themselves accept, the disclosure of sensitive financial information leaves affected customers vulnerable to fraud by criminals.

“If the water companies’ failed to take adequate steps to keep customers’ personal data safe, then those affected are likely to be entitled to compensation for the distress and anxiety caused by the breach as well as any financial losses that they may have suffered.”

Sean Humber, Leigh Day

Gene Matthews, partner at Leigh Day, added:

“This is likely to be an uncertain and deeply worrying time for those affected.

“Sadly, our own investigations, confirm that a considerable amount of information from this data breach is now on the darknet.”

Gene Matthews, Leigh Day

The legal firm is offering those hit by the data breach the chance to take part in a “no win, no fee” compensation claim by completing an online form.

Speaking after the confirmation that personal information had been accessed during the cyber attack, Andy Willicott, managing director or South Staffs Water, said:

“We understand that customers trust us to keep their data safe and I’d personally like to say sorry to all those customers impacted – we’ll be doing what we can to support you through this.

“We will continue to invest in protecting our customers, our systems, and our data.”

Andy Willicott, South Staffs Water