By The KTech team · Published 29 October 2026
What happened
The Information Commissioner's Office (ICO) announced on 11 May 2026 that it had fined South Staffordshire Plc and South Staffordshire Water Plc £963,900. Its announcement is titled Fine of nearly £1m issued against South Staffordshire Plc and South Staffordshire Water Plc following major cyber attack and data breach.
The ICO says the incident began with a phishing email. Someone opened an attachment, and that let the attacker install malicious software which then went unnoticed for around 20 months. In 2022 the attacker gained the highest level of access to the network.
The breach was only spotted when performance problems prompted an internal investigation. The ICO says the personal information of 633,887 people was later published on the dark web.
Among the failings the regulator identified were weak controls that let the attacker widen their access. It also mentioned outdated systems, including an old version of Windows Server. The company agreed a settlement and a reduced fine.
What this means for South Hams homes and businesses
- Teach everyone to treat unexpected attachments with caution, and make it easy to report a suspicious email without feeling silly.
- Retire software that no longer gets security updates, or keep it well away from the rest of your network.
- Limit administrator access to the people who truly need it, so one opened attachment cannot reach everything.
- Pay attention to odd slowdowns. Unexplained performance problems are worth investigating, not ignoring.
- Keep backups separate from your main network so that recovery is possible if the worst happens.
Source: ICO, Fine of nearly £1m issued against South Staffordshire Plc and South Staffordshire Water Plc following major cyber attack and data breach, published 11 May 2026. Accessed 29 October 2026.
This is our own summary. For the full detail, please read the source above.