OrganisationGB

South Staffordshire Water

A UK critical national infrastructure water utility serving the West Midlands, fined £963,900 by the ICO in May 2026 for a 2022 ransomware breach with 20-month dwell time.

The ICO fined South Staffordshire Water £963,900 on 12 May 2026 for a 2022 ransomware breach in which an attacker went undetected for 20 months across 95% of its unmonitored IT estate.

Last refreshed: 3 August 2026 · Appears in 1 active topic

Key Question

If 95 per cent of a water company's IT was unmonitored for 20 months, how many others are in the same position?

Timeline for South Staffordshire Water

#12 29 Jul

Mentioned in: Water plants told to unplug controllers

Cybersecurity: Threats and Defences

#4 12 May

Received £963,900 fine after a 20-month attacker dwell exposing 633,887 individuals' data and 4.1 terabytes of exfiltrated data

Cybersecurity: Threats and Defences: ICO fines South Staffs Water £963,900

View full timeline →

Follow Cybersecurity: Threats and Defences →

Background

South Staffordshire Water, trading as South Staffs Water and Cambridge Water, is a UK water utility supplying drinking water to approximately 1.6 million customers across the West Midlands and Cambridgeshire. The company is a subsidiary of South Staffordshire Plc, operates under Ofwat regulation, and is classified as Critical National Infrastructure under UK Government sector designations.

The South Staffordshire fine establishes that NCSC technical guidance on monitoring coverage and network segmentation now carries enforceable weight via ICO interpretation of existing law, ahead of Parliament finalising the new statutory cyber regime for CNI. It is the first explicit CNI water-sector enforcement action, following the Capita precedent of 2023, and gives regulators a citable template for other Ofwat-regulated utilities with similar monitoring gaps.

Key Issues

CNI enforcement

ICO fines water utility for 20-month gap

The Information Commissioner's Office fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 on 12 May 2026 for a 2022 ransomware intrusion in which an attacker, who entered via phishing, went undetected for 20 months, reached domain administrator privileges and exfiltrated 4.1 terabytes of data . The ICO found only 5 per cent of the company's IT estate was monitored, with no Privileged Access Management and no segmentation between corporate IT and operational technology.

The fine, covering 633,887 affected individuals and including a 40 per cent reduction for early admission, was enforced under existing UK GDPR Article 32 and the Data Protection Act 2018, not the still-pending Cyber Security and Resilience Bill. It is the first explicit CNI water-sector enforcement action, extending the Capita precedent (2023) and giving Parliament a live example of the detection gap its 24-hour notification clause targets.

Common Questions

Why was South Staffordshire Water fined by the ICO?

The ICO fined South Staffordshire Water £963,900 on 12 May 2026 for a 2022 ransomware breach. An attacker remained undetected for 20 months, reached domain administrator level, and exfiltrated 4.1 terabytes of data. The ICO found only 5 per cent of the IT estate was under monitoring.Source: ICO

How much was the South Staffordshire Water fine?

£963,900. The ICO applied a 40 per cent reduction for early admission of liability. The fine covered 633,887 affected individuals under UK GDPR Article 32 and the Data Protection Act 2018.Source: ICO

What went wrong technically in the South Staffordshire Water cyberattack?

The attacker entered via a phishing email and remained undetected for 20 months because only 5 per cent of the IT estate was under active monitoring. There was no Privileged Access Management and no segmentation between corporate IT and operational technology, allowing lateral movement to domain administrator level.Source: ICO

Will other UK water companies be fined after the South Staffordshire ICO precedent?

The ICO's South Staffordshire enforcement explicitly applies the Capita template to critical national infrastructure water utilities. Companies such as Trent Water face the same Article 32 security-of-processing standard and the same ICO enforcement docket before the Cyber Security and Resilience Bill reaches Royal Assent.

Source Material

South Staffordshire Water – Official Website Fine of nearly £1m issued against South Staffordshire Plc

How the World Sees Them

ICO

The 40% reduction for early admission is an established concession; the Capita-template application to water CNI signals the ICO is extending sector-by-sector enforcement before the CS&R Bill reaches Royal Assent.

Ofwat

As the sector economic regulator, Ofwat faces pressure to incorporate cyber-resilience criteria into its regulatory framework, beyond the ICO's data-protection-focused enforcement route.

UK Government

The fine demonstrates existing statutes can enforce security baselines on CNI without waiting for new legislation, but the 20-month detection gap reinforces the case for the CS&R Bill's mandatory reporting requirements.

UK Water Sector

The South Staffordshire precedent is the sector's first explicit GDPR Article 32 fine; Trent Water and other Ofwat-regulated utilities must now treat NCSC monitoring guidance as having ICO enforcement weight.