Keep your Southern Water notification letter, your customer reference number, and your Experian activation link with its two-month deadline. Those items prove you were in the notified group, show which data types were listed for you, and preserve your access to 12 months of monitoring. Southern Water is a utility supplying water and wastewater services in southern England. Southern Water said in its February 2024 customer update that data was stolen from a limited part of its server estate after an illegal intrusion flagged on 23 Jan 2024 and confirmed on 12 Feb 2024.
Table of Contents
- Why did you get this letter?
- Which personal details were listed for you?
- What help was offered and by when?
- What should you file together?
- Where are the limits of the letter?
Why did you get this letter?
Southern Water told a slice of its customer base that personal data may have been stolen. TechCrunch reported that Southern Water would notify 5-10% of its customer base, which points to roughly 230,000-470,000 people given its 2.7M water and 4.7M wastewater customers, in its report on the breach scale. The attack was linked to Black Basta, a ransomware group that encrypts victim systems and threatens to leak stolen files.
Computer Weekly reported in its coverage of the ransomware claim that the group posted Southern Water on its leak site on 22 Jan 2024 and claimed 750GB stolen. Current staff and some former staff were also notified about employment-related data. That makes the letter important for two groups: household customers and people who worked for Southern Water.
Which personal details were listed for you?
Your letter matters because exposure varied by person. Computer Weekly, citing a BBC copy of the customer email, reported that the notification listed names, dates of birth, National Insurance numbers, bank account details and customer reference numbers as possibly stolen. Keep the exact list printed in your own letter. Do not rely on someone else's letter or a news summary.
Your list decides which accounts and records need checks. Banks use sort codes, account numbers, names and reference numbers to match a customer. Identity thieves combine National Insurance numbers, birth dates and addresses for fraud attempts. The combination in your letter is therefore more sensitive than any single item.
What help was offered and by when?
Affected people were offered free enhanced Experian credit monitoring for 12 months plus cyber advice. Activation required action within two months of the letter or email through the provided link. Save the link, the activation code if shown, the date of your letter, and proof you activated.
The published update also gave contact number 0330 303 0025 for questions. Keep any reply or confirmation from Experian with the letter. Southern Water reported the incident to the Information Commissioner's Office, government and regulators, hired forensic experts, and said water supply and financial systems showed no evidence of impact. That response does not replace personal checks on bank statements and credit files.
What should you file together?
Keep the original email with headers or the paper envelope with postmark. Store it with a copy of ID used to claim monitoring, bank alerts from that period, and notes of calls made.
Use one folder, paper or digital, for all four sets. That folder supports later questions from a bank, employer, or regulator. It also avoids repeat searches if the scope changes.
- notification letter or email plus envelope, date received, and sender address
- customer reference number and exact data types listed for you
- Experian link, activation code, activation date, and confirmation message
- bank and credit-file notes, with dates, balances queried, and disputes filed
Where are the limits of the letter?
The 5-10% notification figure was interim while forensic review continued. Keep the letter even if later estimates shift, because it records what Southern Water told you at the time.
The later annual report put response cost at £4.5M, reported by BleepingComputer in its report on breach expenses. Cost and scope updates do not cancel your stored proof of notice. Activate monitoring before the two-month window closes.
You Might Also Like
- Inotiv Data Breach Settlement: How to Distinguish the New Claim Process From Its Securities Case
- Website Outage vs. Data Breach: Why Downtime Alone Does Not Establish Data Theft
- M&S Data Breach: Why an Account Password Reset Does Not Mean Passwords Were Stolen