British utility giant Southern Water says hackers have stolen the personal data of hundreds of thousands of customers

UK-based water utility Southern Water has admitted that hackers stole the personal data of 470,000 customers in a recent data breach.

Southern Water, which provides water and wastewater services to millions of people in south-east England, said in a statement on Tuesday that it plans to notify “5 to 10 per cent” of its customer base that their personal information has been stolen by hackers. It was announced that. A cyber attack that occurred in January.

The utility giant did not say exactly how many people were affected so far. Southern Water spokesperson Simon Fluendi told TechCrunch that the company has about 4.7 million customers and disputed that between 235,000 and 470,000 customers had their data stolen. There was no.

Southern Water points out that the “5 to 10 per cent” figure is based on an ongoing forensic investigation, which suggests the actual number of people affected may be much higher. There is.

Southern Water did not say what data was stolen. BBC News reports that hackers accessed customers' dates of birth, National Insurance numbers, bank account details and reference numbers.

Southern Water also said it would notify “all of our current employees and some former employees” about the breach of their personal information. Southern Water said in its latest annual report that it employs approximately 6,000 people.

The January cyber attack on Southern Water, which the company first disclosed on January 23, was carried out by Black Busta Ransomware Group, the Russia-linked gang responsible for the hack into British outsourcing giant Capita last year. claimed to be a thing.

Southern Water has not yet commented on the details of the incident or how its systems were compromised.

Black Basta listed Southern Water on its dark web breach site shortly after last month's cyberattack, claiming it had stolen 750 gigabytes of sensitive data from the organization, including company documents and customers' personal documents.

The list also includes screenshots that claim to show some of the stolen data, including employee passports and IDs, threatening to release stolen data unless a ransom demand is paid. was.

As of this writing, Southern Water is not listed on the Black Basta website. It is not uncommon for victim companies to be delisted after paying a ransom to hackers. Southern Water did not say whether it had paid the ransom demand.

Southern Water said in a statement on Tuesday that it was working with cybersecurity experts to monitor the dark web. Southern Water said it has found “no new evidence that data potentially relevant to this cyber incident has been published online” since the utility was posted on the ransomware gang's site. There is.

Southern Water said it had notified the UK's data protection regulator, the Information Commissioner's Office, about the incident.