We have taken all necessary steps in response including:

• Taking immediate steps to contain the attack and reduce the risk of any further access by the criminal cyber group

• Engaging leading IT security experts to investigate exactly what happened
  

• Launching an extensive IT forensic investigation into the incident to assess what data was impacted in the incident
  

• Notifying the National Cyber Security Centre, Action Fraud, the National Crime Agency, the Information Commissioner’s Office (ICO), Ofwat, and the Consumer Council for Water, along with the Drinking Water Inspectorate and the Department for Environment, Food and Rural Affairs (DEFRA)
  

• For those customers where necessary, notifying them to let them know what happened and the support we are offering. This includes setting up a dedicated helpline to answer questions and offering free access to a credit monitoring service for a year

• Name
• Address
• Phone number
• Email
• Date of birth
• Bank details, if you pay by Direct Debit (if you pay by card, we don't store card details)
• Password, if you use MyAccount (this is encrypted)
• The reason why you or somebody else at your address is registered on the Priority Services Register

• Please check your email junk/spam junk folder to see if the activation email has been delivered there
• Please double check you entered your email address correctly on the TransUnion website
• If you still haven't received your activation email after carrying out steps one and two, please email uktrueidentity@transunion.com and the team will be able to assist you.

• Phishing is when a criminal tries to obtain personal information from you via email to use for fraud or other crimes
• Vishing is when criminals call you to try and obtain information from you.

In both cases, it is very common for the criminal contacting you to pretend to be calling from a company or utility you trust. One of the best ways to prevent phishing and vishing is to understand the red flag warning signs which are:

• An unfamiliar greeting or tone
• Unsolicited calls or emails
• Grammar and spelling errors
• A sense of urgency from the person contacting you
• Suspicious links or attachments in emails
• Requests for personal information
• Inconsistencies in email addresses, links etc.
• Unusual requests
• An alert that you have won something
• Fake unsubscribe messages

• STOP: Take a moment to stop and think before parting with money or information
• CHALLENGE: Could it be fake? It’s OK to reject, refuse or ignore any requests. You can always call a company back before you make a payment using a trusted phone number or contact email from their website. Only criminals will try to rush or panic you into an immediate payment
• PROTECT: Contact your bank immediately if you think you’ve fallen for a scam and report it to Action Fraud

For more information on how to protect yourself online visit the National Cyber Security Centre website.