Southern Water Data Breach Compensation Claims Guide

On 13th February, some customers of Southern Water were said to have received notification that they were impacted by a data breach.

The company, which provides water and waste services to 4.7 million people across Kent, Hampshire, Sussex and the Isle of Wight has confirmed that some customer data has been stolen by hackers.

Already, Legal Expert has received enquiries and requests for legal advice from concerned individuals. We’ve also received lots of queries from people interested in claiming Southern Water cyber attack compensation.

In this guide, we explain your legal rights. We also look at the Southern Water data breach, compensation claims, and what you can do to secure your personal data.

If you’d rather speak with us now to get advice if you’ve been impacted, we operate a 24-hour phone line and a live chat service. We understand how distressing a data breach can be, so call us on 0800 073 8804 today, or click below to complete our claim form.

Key Information On The Southern Water Data Breach And Compensation Claims

• If you’ve received a letter from Southern Water about the data breach, call our free helpline to see if you can claim compensation.
• The breach is said to have impacted both customers and current and former employees. It’s estimated up to 500,000 people have been impacted.
• Accepting Southern Water’s offer of free enhanced Experian credit monitoring does not prejudice you in making a compensation claim if you’ve been impacted by the breach.

What Was The Southern Water Data Breach?

On 12th February, Southern Water issued a statement on the cyber attack. The key facts from the statement include:

• Suspicious activity was first detected on 23rd January 2024 on the company’s IT systems. Southern Water’s employee and customer data then began to surface on the dark web.
• Subsequently, around 5-10% of the customer base (approximately 450,000-500,000 people) is said to have been impacted and that their personal data may have been exposed to the hackers.
• Current and past employees have also been notified, though Southern Water hasn’t confirmed whether employee personal data has been affected. However, reports from The Telegraph state that up to 2,000 employees could be impacted.
• The firm has offered enhanced Experian credit monitoring for 12 months free of charge to affected individuals.
• The Information Commissioner’s Office (ICO) has been notified and is investigating. The National Cyber Security Centre is also assisting.
• Essential water services remain unaffected.

The hack was said to have been conducted by Russian group, Black Basta, which was behind the South Staffordshire Water data breach last year and the attack on their IT systems. Legal Expert is currently representing hundreds of clients in a claim against South Staffordshire Water.

The hacking group was also behind the Capita data breach. Again, we’re currently representing hundreds of clients in respect of this cyber attack.

What Data Was Affected?

It has yet to be confirmed what data has been impacted in the breach. The only statement made by Southern Water was that “personal data” has been affected. This is likely to involve:

• Names
• Addresses
• Email addresses
• Dates of birth
• National insurance numbers

However, it’s also possible that other types of data could have been impacted, such as:

• HR documents
• Identity documents, like utility bills, passports or driving licenses.
• Bank account numbers
• Sort codes
• Payment reference numbers

It has been reported by The Register that files stolen by the hackers and posted online contained some of the information listed above.

If any of the data listed above has been involved in your breach, click here to complete our claim form.

Legal Expert’s Analysis Of The Southern Water Data Breach

Eleanor Coleman, Head of our Data Breach department, said on the Southern Water breach:

“We are aware that there has been a cyber attack on Southern Water, the latest in a long list of cyber attacks on various organisations and companies in the last year.

We appreciate it is concerning for clients to find out that their personal and sensitive information has been subject to a cyber-attack, especially when it relates to financial and banking information.

We also understand that it is difficult for clients to feel that they have any control over their personal information when these attacks occur; especially in the case of Southern Water where clients do not have a choice in water provider and cannot switch to a different organisation.

We understand that Southern Water have offered Experian credit monitoring for 12 months, which we would recommend is a good option for clients to accept, but it is not sufficient to compensate clients properly for this breach of their information.”

How Many People Are Said To Be Affected By The Southern Water Data Breach?

It’s estimated that around 5 to 10% of Southern Water’s 4.7 million customers have been impacted. This means up to 500,000 people have been impacted.

Additionally, it’s estimated that around 2,000 of Southern Water’s current and former employees have been affected.

What Should I Do If I Receive A Data Breach Notification Letter From Southern Water?

If you receive a letter or email from Southern Water notifying you of the data breach, it should contain details about what personal data of yours was impacted.

It’s also been reported in the media that affected customers have also been offered a 12-month subscription to Experian. This is to help monitor any suspicious activity with your credit rating.

It’s important to take advantage of this to monitor your credit score as hackers may use the data they have on you to take out credit in your name.

It’s also advisable to speak with your bank to advise them of the issue. They may make recommendations, such as setting up a new account.

You can also seek legal advice on whether you can claim Southern Water cyber attack compensation, especially if you’re feeling distressed, anxious or worried. If you’d like advice on the Southern Water data breach and compensation claims, get in touch with us for free today. You can click here to complete our claim form.

Do I Need To Report The Data Breach To The Information Commissioner’s Office (ICO)?

It’s not necessary to report the data breach to the Information Commissioner’s Office given that Southern Water has already notified them of it. However, speaking with the ICO if you have concerns is encouraged.

The ICO has stated:

“…if anyone is concerned about how their data has been handled or they are concerned about a potential breach, they should get in touch…”

Can I Claim Compensation For The Southern Water Cyber Attack?

In order to claim compensation for the Southern Water data breach, it’s necessary to meet certain criteria. These are:

• That you were impacted either psychologically or financially by the data breach. For example, you suffered significant worry at learning that your data has been exposed and could be used by hackers or criminals. Financial damage could involve your credit rating being impacted or money stolen from your bank accounts.
• That there was some form of positive wrongful conduct on the part of the organisation. For example, a failure to audit or update their cyber security systems.

Even though you may have been impacted by the Southern Water data breach, compensation may not be awarded if you do not meet the two criteria above.

If you’d like to discuss your case with us to see if you meet the criteria, get in touch with us using the number at the top of the page or via our live chat.

If you’d like to learn more about claiming data breach compensation, head here.

Key Information On The Southern Water Data Breach And Compensation Claims

If we can see that you have a potential Southern Water data breach claim, we could offer to represent you on a No Win No Fee basis.

No Win No Fee is a phrase you may have heard before. It simply means that if your claim doesn’t succeed, you won’t be obligated to pay your solicitor any fees. It also means you don’t have to pay any fees to begin the claim, nor anything while the claim progresses.

Only if your claim ends in a compensation award do you have to pay a fee, and this is deducted from the money you receive. The fee you pay is capped by law at a low level.

If you’d like to enquire about making a data protection breach claim for the Southern Water cyber attack, or about claiming compensation generally, get in touch with us at the number at the top of this page.

You can also write to us about your case here.