Black Basta Group Removes Southern Water from Target List

Southern Water, one of the largest water supply and sanitation suppliers in the UK, has acknowledged that approximately 5 to 10 percent of its customers have had their data stolen due to a cyber attack in January. The company made this announcement in an official statement.

Fears about the security of the company’s employees, who were also affected by the incident, have been raised alongside this information. Southern Water plans to directly contact the affected clients in the coming days.

Although Southern Water has not explicitly confirmed that the cyber attack was the cause of the incident, the Black Basta cybercrime group, which had claimed responsibility for the attack, has already leaked some of the stolen data on the internet. Among the published information were personal documents and files from personnel services.

The company has notified its customers through letters about the potential theft of their names, dates of birth, national insurance numbers, bank account numbers, and other personal information. To support the affected customers, Southern Water is providing a free annual subscription to the Experian IdentityWorks service for credit history monitoring.

According to the Southern Water official website, the company serves 2.5 million water supply customers and over 4.7 million drainage customers, which means that hundreds of thousands of customers may receive notification letters regarding the data theft.

The company has stated that, despite the incident, its operations and services for customers have not been compromised. Southern Water is actively collaborating with the government, regulators, the National Cybersecurity Centre, and has also notified the police and data protection department.

In response to the incident, the company’s IT security team has implemented additional measures to protect its internal systems.

It is worth noting that the Black Basta cybercriminals have already removed Southern Water information from their leaks. This usually occurs after a ransom has been paid,