In August, South Staffordshire PLC, the parent company of South Staffs Water and Cambridge Water, announced that it was hit by a criminal cyber-attack. As soon they discovered the incident, we immediately launched an investigation to understand what had happened, supported by a specialist team.

The forensic investigation into what data has been impacted is meticulous and, in cases like this, often take months to reach a conclusion. Whilst we want to work quickly, it is also vital that we take the time to get it right, which we are determined to do. In this case, the investigation hasn't yet finished, but as soon as we identified this group of customers where we could confirm their data had been impacted, we have acted without undue delay to contact them to let them know.

South Staffs PLC discovered the incident in July and took immediate steps to contain the attack and investigate fully what had happened. To do this, they launched an extensive forensic investigation to understand what data has been compromised with specialist third-party support. This is ongoing but we are letting you know about this now given we’ve confirmed that your data was impacted.

Investigations like this are very complex and it takes time to understand what happened and then to analyse the data that could have been impacted. As soon as we were aware that we needed to notify our customers in compliance with our legal obligations, we began to do so.

We have many measures in place to protect our networks and the data we hold. We recognise that personal information is entrusted into our care and regret any inconvenience caused by this incident. Since we detected the incident, we have supplemented these existing measures with additional information security tools.

We have taken all necessary steps in response including:

• Taking immediate steps to contain the attack and reduce the risk of any further access by the criminal cyber group

• Engaging leading IT security experts to investigate exactly what happened
  

• Launching an extensive IT forensic investigation into the incident to assess what data was impacted in the incident
  

• Notifying the National Cyber Security Centre, Action Fraud, the National Crime Agency, the Information Commissioner’s Office (ICO), Ofwat, and the Consumer Council for Water, along with the Drinking Water Inspectorate and the Department for Environment, Food and Rural Affairs (DEFRA)
  

• For those customers where necessary, notifying them to let them know what happened and the support we are offering. This includes setting up a dedicated helpline to answer questions and offering free access to a credit monitoring service for a year

As soon as we detected the incident, we engaged leading IT security experts to work with us to contain the attack and reduce the risk of any further access. They are also investigating exactly what happened and have made recommendations on additional IT security enhancements. We have already introduced a number of enhancements.

Yes, as soon as we discovered the incident, we notified the Information Commissioner’s Office in line with our legal obligations and have been keeping them updated as our investigation progressed. Separately, we’ve also notified the National Cyber Security Centre and the National Crime Agency.

Yes, since discovering the incident we have been closely liaising with the police via the National Crime Agency.

We hope you can understand that as this is a police matter, we can’t share any details.

We hope you can understand that as this is a police matter, we can’t share any details.

The investigation has shown some of the personal data we store on you was impacted in the criminal cyber attack. That is why you have received this notification – so that we can explain what happened and the support we are offering you.

We hold this data so that we can operate your water account and supply you with fresh drinking water.

At this point of our investigation, which is ongoing, we have confirmed that only a subset of our customers who pay by Direct Debit have been impacted. For those that are being notified, for logistical reasons, we are staggering the notification letters over three or four days, so it is possible that your letter may arrive in the next day or two. As you know there are a number of postal strikes at the moment, and we are aware that these have caused some disruption to deliveries.

It is a regulatory requirement to provide you with certain information including details of the support package we are providing to you. There is a lot of information that we are required to share, and we wanted to give you the time to be able to read through it which is why we sent you a letter about this in the post.

Typically, we hold the following information to operate your water account and provide you with fresh drinking water - your:

• Name
• Address
• Phone number
• Email
• Date of birth
• Bank details, if you pay by Direct Debit (if you pay by card, we don't store card details)
• Password, if you use MyAccount (this is encrypted)
• The reason why you or somebody else at your address is registered on the Priority Services Register

The data affected in the incident was the name and address of the water account holder, together with the sort code and account number used for the Direct Debit and other information needed to operate your water account and provide you with fresh drinking water.

In some cases, it also included the details we hold to allow us to provide specialist services to you, for example to prioritise you for bottled water during a supply incident, or details of a special tariff, or to communicate with you in a particular format. The information compromised could be about you or somebody else who lives in your household. 

No, no passwords were impacted.

Please note that passwords have not been compromised. If you still want to change it, you are welcome to do so – please update your records using our PSR form.

Our investigation into this incident is ongoing and we are still assessing the potential impact on customer data. As we identify groups of customers who need to take action because their data has been impacted we are, of course, notifying them as soon as possible.

If you have not received a notification letter from us then you do not need to take any action at this stage as there is no evidence at the moment that your personal data has been impacted. Our investigation into the incident continues and we will continue to ensure we are complying with our legal and regulatory requirements as we respond to this matter.

Due to logistical reasons, we sent the notification letters to all customers, whose data was impacted, over three days, between 25th and 29th November. Customers should therefore begin to receive their letters soon.

The credit monitoring service we are offering you, TrueIdentity, will help you identify if your data may have been misused by alerting you of any changes to your credit report.

We are only notifying our main water account holder at each address. We are aware that this may relate to a different member of the household. You might like to discuss the notification with them, if it is appropriate to do so.

We regret the concern this has caused and want to assure you that we are committed to supporting you. That is why we are offering you free access to a credit monitoring service, TrueIdentity, for twelve months. The service will alert you if any of your personal data has been compromised on the dark web, helping you stay protected. It is important to be aware that your personal details may already be on the dark web as cyber attacks are now commonplace and therefore may not originate from this incident. The notification letter we sent you includes more information on the service, including how to register for it, and who to contact with more questions.

We also have a mobile community support team, which will be travelling around Cambridge over the next four weeks to speak with customers. View dates, times, and locations.

TransUnion is one of the three FCA regulated credit reference agencies in the UK (along with Experian and Equifax).
TransUnion receives hundreds of millions of personal data records each month from numerous sources and stewards this information with care, with rigorous safeguarding processes in place. The protection of consumer information is TransUnion’s top priority and they deploy a multi-layered security programmes, constantly enhancing and refining their controls to address the latest security threats.

For more detailed information on how TransUnion use personal data in connection with the use of the TrueIdentity website/service, please refer to the Privacy Policy which can be accessed through the bottom of the Trueidentity website.

You’ll be asked for your personal details including your name, telephone number, address, and personal email address so TransUnion can verify your identity and create your Trueidentity account.

You will also be asked a series of knowledge-based authentication questions which relate to the information held on your credit report, so it may help to have a copy of any financial/lending agreements available to support you in answering these.

We are sorry that we can’t create your TransUnion account for you. During the sign-up process you’ll be asked for personal data that we don’t hold about you, you’ll need to set up passwords and there are also authentication questions which require some knowledge of your financial affairs. It simply isn’t possible for us to do this for you.

• Please check your email junk/spam junk folder to see if the activation email has been delivered there
• Please double check you entered your email address correctly on the TransUnion website
• If you still haven't received your activation email after carrying out steps one and two, please email uktrueidentity@transunion.com and the team will be able to assist you.

Please ensure you use the specific URL in your letter to access the TrueIdentity website, this will take you to the correct UK TransUnion website. If you use an internet search engine to find the TrueIdentity website, it is likely you will reach the USA website instead.

TrueIdentity will be available to provide you with help and support for 12 months from signing up to them. In order to take advantage of this service you will need to sign up by 1st March 2023.

Of course, we all need to be vigilant for fraud and scams. In particular we recommend that you are on your guard for unsolicited phone calls, emails, text messages and even callers to your home asking for personal information. Action Fraud has lots of helpful advice on how to stay safe.

The TrueIdentity monitoring service that we are offering will scan the dark web and notify you if your personal information is found online. It is important to be aware that your personal details may already be on the dark web as cyber attacks are now commonplace and therefore may not originate from this incident. If you have any questions about TrueIdentity, or have difficulty registering, or require additional support, please contact TransUnion.

There’s no need to report this to the police as we’ve already reported this incident to police authorities via Action Fraud and the National Crime Agency.

• Phishing is when a criminal tries to obtain personal information from you via email to use for fraud or other crimes
• Vishing is when criminals call you to try and obtain information from you.

In both cases, it is very common for the criminal contacting you to pretend to be calling from a company or utility you trust. One of the best ways to prevent phishing and vishing is to understand the red flag warning signs which are:

• An unfamiliar greeting or tone
• Unsolicited calls or emails
• Grammar and spelling errors
• A sense of urgency from the person contacting you
• Suspicious links or attachments in emails
• Requests for personal information
• Inconsistencies in email addresses, links etc.
• Unusual requests
• An alert that you have won something
• Fake unsubscribe messages

Attempts to gather personal data and instances of fraud are commonplace in today’s world so you should always remain vigilant. The simple stop, challenge, protect approach can help you to stay safe whether you are approached via phone, email or face to face at your door.

• STOP: Take a moment to stop and think before parting with money or information
• CHALLENGE: Could it be fake? It’s OK to reject, refuse or ignore any requests. You can always call a company back before you make a payment using a trusted phone number or contact email from their website. Only criminals will try to rush or panic you into an immediate payment
• PROTECT: Contact your bank immediately if you think you’ve fallen for a scam and report it to Action Fraud

For more information on how to protect yourself online visit the National Cyber Security Centre website.

If you do not receive a notification from us, then you do not need to take any action at this time.

If you do not receive a notification from us, then you do not need to take any action at this time.

If you do not receive a notification from us, then you do not need to take any action at this time.

If you do not receive a notification from us then you do not need to take any action at this time.

We’ve been working with advisors who have experience in responding to these issues as we really want to do what we can to support you in the best way possible. The expert advice we have received is that 12 months is appropriate as it covers the period of anticipated likely risk. Beyond that time, there are free credit monitoring services available, such as ClearScore, which we recommend you consider.

Yes, our customer service and billing systems are all operating as usual, and it is safe to pay your bill as you normally do.

No. We have a legal obligation to provide you with water, and to do so you must hold an account with us.

The dark web is part of the internet that isn't visible to search engines.

Of course, we all need to be vigilant for fraud and scams. In particular we recommend that you are on your guard for unsolicited phone calls, emails, text messages and even callers to your home asking for personal information. Action Fraud has lots of helpful advice on how to stay safe.

If you would like to let your bank know that your Direct Debit details have been compromised in this incident, then please feel free to do so. They will advise you on what steps you should take.

Your bank should be able to advise you on whether they recommend this.

The notification letter explains all the information we know that was impacted in the incident at this time relating to you.

Yes, you should show them a copy of the notification you have received.

Yes, this incident did not affect our ability to supply safe water and we are still supplying water to all of our Cambridge Water and South Staffs Water customers.

You don’t need to change anything about how you normally use your water. The water is still safe to use and drink.

The Drinking Water Inspectorate is an independent regulator - which has very stringent standards that we must, and do, comply with at all times. They also have a rigorous, ongoing system of checks in place to ensure that water is safe.

Cyberscout is part of TransUnion, the credit monitoring provider we are offering affected customers free access to. We’ve engaged Cyberscout to run a special helpline to support our customers so that we can answer their questions on the notification as swiftly as possible.