South Staffs Water Hack Left Customers Dealing With Identity Theft and Broken Trust

Massive data breach at South Staffordshire Water exposed 633,887 people's info, leading to fines and ongoing struggles for victims.

By Content Team

Jun 10, 2026

ON THIS PAGE

A phishing email in September 2020 gave attackers a foothold in South Staffordshire Water that went undetected for 20 months. Between August and November 2022, more than 4.1 terabytes of data belonging to 633,887 people appeared on the dark web — customers' bank details and staff National Insurance numbers among it.

Chris Durham, 53, from Halesowen, had two phone contracts taken out in his name, including an expensive iPhone shipped to north-east London. His £14-a-month PAYG account started being debited £60, and it took months to get the money back. "I was frustrated, stressed and violated. I was robbed," he said. Nigel Calladine, 75, changed his email address and bank accounts entirely after six months of phishing.

The ICO fined South Staffordshire £963,900 under a voluntary settlement, reduced by 40% after the company admitted liability early and agreed not to appeal. The firm says it placed dedicated advisors during the incident, offered free credit monitoring, and has since invested significantly in its cyber resilience. Calladine isn't convinced: "The people who pay the fine are the people who were hacked, so the customer loses out twice."

Source: BBC News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?