If you never got a letter after the Southern Water breach, ask whether your account fell in the affected 5–10% cohort. Also request a copy of the personal data it held on you through its Data Protection Officer route. Southern Water is the utility serving Kent, Sussex, Hampshire and the Isle of Wight.
Black Basta claimed a January 2024 ransomware attack on its leak site on 22 January. Southern Water later confirmed customer and employee data was stolen from part of its server estate. Computer Weekly reported the confirmation in its February 2024 report.
Table of Contents
- Were you in the affected 5–10%?
- What customer data was at risk?
- How do you ask in writing?
- What monitoring and follow-up help?
Were you in the affected 5–10%?
Southern Water said 5–10% of its customer base was affected. That equals roughly 230,000–460,000 people out of millions served. TechCrunch detailed the estimate in its February 2024 coverage.
Absence of a letter does not prove you were unaffected. Scoping, old addresses and phased notification can leave gaps. DataBreachLaw guidance warns unnotified people to stay alert and check records.
What customer data was at risk?
Stolen customer data could include names, dates of birth and customer reference numbers. It could also include National Insurance numbers where held and bank account details.
The BBC, via Freevacy, listed those categories and noted employee ID scans and HR files in leaked samples in its summary of BBC reporting. Water and wastewater operations and customer financial systems were not disrupted. Southern Water reported the incident to the UK Information Commissioner's Office. It also worked with the National Cyber Security Centre, as CPO Magazine noted.
How do you ask in writing?
Southern Water Privacy Policies point to its Data Protection Officer contact route for rights or complaints. Use that route to put your questions in writing. Keep a copy with dates.
Include three points in one message. State your full name, address history and account details if you have them. Ask for a written reply stating the outcome. If the reply is unclear, restate the question and keep the thread together.
- Ask whether your account was in the affected 5–10% cohort.
- Request a copy of the personal data held on you.
- Put any rights request or complaint through the Data Protection Officer route and ask for a written reply.
What monitoring and follow-up help?
The company said it would directly notify anyone whose data was found stolen. It offered affected people 12 months of Experian Identity Plus monitoring. The Register reported the offer must be activated within two months of the letter or email in its February 2024 report.
Monitor bank statements and credit files for unfamiliar entries. Report suspected misuse to the company promptly. If unresolved, take the complaint to the ICO, as DataBreachLaw guidance advises.
You Might Also Like
- Southern Water Data Breach: What to Keep From Your Notification Letter
- Southern Water Data Breach: How to Check the Identity-Monitoring Offer in Your Letter
- Southern Water Data Breach: Questions for Customers Who Have Moved House