In August 2022, South Staffordshire PLC, the parent company of South Staffs Water and Cambridge Water, announced that it was hit by a criminal cyber-attack. As soon as they discovered the incident, they immediately launched an investigation to understand what had happened, supported by a specialist team. The investigation found that some South Staffs Water and Cambridge Water customer data was impacted. We have sent letters to customers whose data was involved so that they can take the appropriate action.

Investigations like this are very complex. It is common in incidents of this nature for it to take time to understand what happened and then to analyse the data that could have been impacted. As soon as we could identify which customers we needed to notify we began to do so, in compliance with our legal obligations.

We have taken all necessary steps in response including:

• Taking immediate steps to contain the attack and reduce the risk of any further access by the criminal cyber group

• Engaging leading IT security experts to investigate exactly what happened
  

• Launching an extensive IT forensic investigation into the incident to assess what data was impacted in the incident
  

• Notifying the National Cyber Security Centre, Action Fraud, the National Crime Agency, the Information Commissioner’s Office (ICO), Ofwat, and the Consumer Council for Water, along with the Drinking Water Inspectorate and the Department for Environment, Food and Rural Affairs (DEFRA)
  

• For those customers where necessary, notifying them to let them know what happened and the support we are offering. This includes setting up a dedicated helpline to answer questions and offering free access to a credit monitoring service for a year

• Name
• Address
• Phone number
• Email
• Date of birth
• Your bank details if you pay by Direct Debit
• If you pay by card, we don't store card details
• Your password if you use our online MyAccount
• The reason why you or somebody else at your address is registered on the Priority Services Register

• Please check your email junk/spam junk folder to see if the activation email has been delivered there
• Please double check you entered your email address correctly on the TransUnion website
• If you still haven't received your activation email after carrying out steps one and two, please email uktrueidentity@transunion.com and the team will be able to assist you.

• Phishing is when a criminal tries to obtain personal information from you via email to use for fraud or other crimes
• Vishing is when criminals call you to try and obtain information from you.

In both cases, it is very common for the criminal contacting you to pretend to be calling from a company or utility you trust. One of the best ways to prevent phishing and vishing is to understand the red flag warning signs which are:

• An unfamiliar greeting or tone
• Unsolicited calls or emails
• Grammar and spelling errors
• A sense of urgency from the person contacting you
• Suspicious links or attachments in emails
• Requests for personal information
• Inconsistencies in email addresses, links etc.
• Unusual requests
• An alert that you have won something
• Fake unsubscribe messages

• STOP: Take a moment to stop and think before parting with money or information
• CHALLENGE: Could it be fake? It’s OK to reject, refuse or ignore any requests. You can always call a company back before you make a payment using a trusted phone number or contact email from their website. Only criminals will try to rush or panic you into an immediate payment
• PROTECT: Contact your bank immediately if you think you’ve fallen for a scam and report it to Action Fraud

For more information on how to protect yourself online visit the National Cyber Security Centre website.