Cambridge Water says customers' names, addresses, and banking details were stolen in the South Staffs Water hack

Cambridge Water has confirmed that a cyber attack targeting its parent company, South Staffordshire Water, compromised the personal sensitive information of its customers.

In August this year, South Staffs Water said it suffered a major ransomware attack that disrupted its corporate IT network. However, the cyber attack did not interrupt the water supply to the company’s customers or to those of its subsidiaries, Cambridge Water and South Staffs Water.

Last month, South Staffordshire PLC confirmed that the data breach compromised the personal and financial information of its customers. In a notification sent to affected customers, the company confirmed that the cyber attack compromised financial information like bank sort codes and account numbers of certain customers who paid their water bills via Direct Debit.

Sensitive personal information like names and addresses and other personal information of customers were also compromised and published by hackers on the Dark Web.

Now, Cambridge Water has confirmed that the sensitive personal information of its customers, like names, addresses, and bank account details, was also compromised in the August data breach and has been published by hackers on the dark web.

In a notification sent to affected customers, the water company said, “We can now confirm that the data of yours that was impacted includes your name and current address, the bank details you provided for your direct debit payments to us, and may also include other personal data which we process about you to provide you with clean water and related services.

“There is a risk that cybercriminals may try to use this compromised data to carry out fraud, in particular by submitting fraudulent direct debits to your bank or building society using the data compromised in the cyberattack,” the company said.

In a statement, Andy Willicott, managing director of Cambridge Water, said, “We understand that customers trust us to keep their data safe and I’d personally like to say sorry to all those customers impacted – we’ll be doing what we can to support you through this.”

Commenting on the news, Erfan Shadabi, Cybersecurity Expert at comforte AG, said, “It might come as a surprise to some that a water supply company was targeted, but we should remember that any organisation that holds sensitive information is one that should anticipate a cyber-attack at any time, because threat actors can use that sensitive information as leverage to induce ransom payments. Your data is their target.

“An end-to-end data security platform can mitigate the severity and fallout of these attacks by finding and labelling sensitive data, then protecting it with data-centric security methods such as tokenisation or format-preserving encryption.

“Tokenisation, for example, can replace sensitive information with representational tokens that are indecipherable, though the tokenized information still retains the original data format. Threat actors might get their hands on it, but if they can’t understand it then they can’t use it as leverage,” he added.