Southern Water spent £4.5 million to respond to a Black Basta ransomware attack

Private utility company Southern Water said that the data security incident it suffered last year cost it approximately £4.5 million to remediate.

 

In January 2024, the Black Basta ransomware group listed Southern Water as a victim on its data leak site and gave the water utility a deadline of six days to pay a ransom, threatening to publish the stolen data if the money wasn’t paid.

 

The group claimed to be in possession of 750 gigabytes of sensitive data, including users’ personal documents and corporate documents. The group also shared screenshots of the stolen data to prove that it had in its possession the passports, ID cards, and personal information of some employees of Southern Water.

 

Acknowledging the claims of the threat group, Southern Water, which treats wastewater and provides water supply in Hampshire, the Isle of Wight, West Sussex, East Sussex and Kent, said in a press release that it was aware of the claimed cyber attack. 

 

The water utility added it previously detected suspicious activities in its internal network and carried out an investigation, with help from external cyber security experts, to determine the scope of the cyber security incident.

 

“Since then, a limited amount of data has been published. However at this point there is no evidence that our customer relationships or financial systems have been affected. Our services are not impacted and are operating normally,” Southern Water said.

 

The company in its recently-released financial report for the 2023–24 financial year said that the data security incident cost it a whopping £4.5 million to remediate.

 

“We engaged external cyber security experts and legal advisers in response, as well as contacting anyone whose personal data may have been at risk. We have incurred £4.5 million in responding to this exceptional incident during the year,” reads the report.

 

The company added that it contracted cyber security experts to continually monitor the dark web for data leaks, which has not occurred yet.