South Staffordshire, made up of South Staffordshire Plc and South Staffordshire Water Plc, was ordered to pay £963,900 by the Information Commissioner's Office (ICO) following the cyber attack, traced back to September 2020.

The firm supplies south Staffordshire, parts of the Black Country and surrounding areas.

Personal information of 633,887 people was taken and published on the dark web in the attack, which largely took place between May and July 2022, the ICO found.

The watchdog and water company agreed a voluntary settlement and South Staffordshire made an early admission of liability, agreeing to pay the penalty without appeal.

A phishing email was used to launch the hack which allowed the cyber attackers to install malicious software and it remained undetected within the organisation's systems for 20 months.

In May 2022, the hacker went through the firm's network and took over administrator privileges — the highest level of system access to the IT network, the ICO said.

Ransom note

The breach came to light when IT performance issues prompted an internal investigation on 15 July 2022.

The company reported a personal data breach a few days later before, on 26 July 2022, South Staffordshire found a ransom note that the hacker had unsuccessfully attempted to send to certain members of staff.

Between August and November 2022, South Staffordshire discovered more than 4.1 terabytes (TB, each equal to 1,000GB) of data were published on the dark web.

They included bank details of customers and National Insurance numbers of staff.

The ICO's investigation found South Staffordshire failed to bring in adequate security controls under UK data protection law, which allowed the hackers to get administrator access.

They were also allowed to operate largely undetected due to minimal monitoring of their activities, the use of obsolete systems by the firm and take advantage of failures including a lack of regular security scans.

Ian Hulme, from the ICO, said: "Waiting for performance issues or a ransom note to discover a breach is not acceptable. Proactive security is a legal requirement, not an optional extra."

Follow BBC Stoke & Staffordshire onBBC Sounds,Facebook,XandInstagram.

The BBC is in multiple languages

Read the BBC In your own language

Oduu Afaan Oromootiin

Gujarati ગુજરાતીમાં સમાચાર

Noticias para hispanoparlantes

Punjabi ਪੰਜਾਬੀ ਖ਼ਬਰਾਂ

Swahili HABARI KWA KISWAHILI

Tamil தமிழில் செய்திகள்

Telugu తెలుగు వార్తలు

Vietnamese TIẾNG VIỆT

Welsh NEWYDDION

Yoruba ÌRÒYÌN NÍ YORÙBÁ

Follow BBC on:

Water firm fined after customers' details hacked

South Staffordshire Water fined after customers' details hacked

Water firm fined after customers' details hacked

Ransom note

'Worrying precedent' as hackers target water firm

Water customers' bank details may have been leaked

Hack leaves water customers feeling vulnerable

Information Commissioner's Office

South Staffordshire Water

'Aladdin's cave' of stolen plant machinery seized

Special needs focus at boxer's 'dream' gym

'No-confidence vote worked in our favour' - Reform

The BBC is in multiple languages

Read the BBC In your own language

We Care About Your Privacy

How and why we process data