South Staffordshire Water has been fined nearly £1m after a major data breach exposed 630,000 people. Register for updates if one of our partner law firms takes a claim forward.
Join the Claim isn’t a law firm. We connect you with regulated UK firms that run group action claims. If one of our partner firms takes this case forward, we’ll share more details, including how to check your eligibility.
Join the Claim Limited is a claims management company. This claim is not regulated by the Financial Conduct Authority. Join the Claim Limited is authorised and regulated by the FCA (FRN: 1053404) for regulated claims management activities only.
Register your interest
Overview
Between 2020 and 2022, South Staffordshire Water experienced a huge data breach. The privacy violation affected both South Staffs Water and Cambridge Water, which are owned by South Staffordshire Water plc.
The breach happened when criminals stole personal and financial information from water company customers and employees.
In total, highly sensitive personal information belonging to more than 630,000 people was exposed in the breach.
Personal information, including bank details, was potentially leaked on the dark web following the cyber-attack, leaving customers and employees of both water companies at risk.
In May 2026, the Information Comissioner’s Office (ICO), fined South Staffordshire Water £963,900 for its data security failings. None of this money will go to victims of the data breach.
If your personal data has been compromised, you may be entitled to compensation.
Register your interest today, and we will keep you updated if one of our regulated UK partner law firms is able to take a claim forward.
South Staffordshire Data breach – At a glance
Take a moment to answer a few simple questions so we can understand your connection and keep you updated.
Share your details so we can keep you informed if any updates become available.
If a partner law firm takes this claim forward, we’ll let you know the next steps and how to join.
South Staffordshire Water suffered a major cyberattack that exposed sensitive customer and employee data. In May 2026, the Information Commissioner’s Office (ICO) fined the company £963,900 after finding that hackers linked to the Cl0p ransomware group had remained inside its systems for almost two years before the breach was discovered in 2022.
The ICO said cybercriminals were able to access and publish large amounts of personal data online, including names, addresses, dates of birth, bank details and National Insurance numbers. The regulator also identified several security failings, including outdated systems and missing security updates.
The ICO says South Staffordshire Water only discovered the cyberattack in July 2022 after investigating unexplained IT slowdowns affecting its systems. Investigators later found that hackers had already been inside parts of the company’s network for almost two years.
Yes. In May 2026, the Information Commissioner’s Office (ICO) fined South Staffordshire Water £963,900 following its investigation into the breach. The regulator said the company failed to implement several basic cyber security measures.
According to the ICO, hackers accessed and published around 4.1 terabytes of data linked to South Staffordshire Water and Cambridge Water customers and employees. The exposed information may have included names, addresses, dates of birth, bank account details and National Insurance numbers.
In some cases, information relating to vulnerable customers registered for priority support services was also reportedly exposed. Data breaches involving this type of personal and financial information can increase the risk of scams, fraud and identity theft.
Yes. The ICO says the exposed data may have included bank account details alongside other personal information such as names, addresses, dates of birth and National Insurance numbers.
South Staffordshire Water has contacted customers and employees believed to have been affected by the breach. If you received a notification from South Staffordshire Water or Cambridge Water, your personal information may have been compromised in the attack.
If you did not receive a notification, it is less likely that your data was affected. However, organisations sometimes identify additional impacted individuals as investigations continue.
Potentially, yes. The ICO said some of the leaked information related to customers registered for priority support services, including data that may indicate disabilities or vulnerabilities.
By registering, you’ll stay up to date with any developments — from investigations to possible legal action.
If you believe your information may have been affected, you should remain alert to scams, phishing emails and unusual financial activity. It is also sensible to monitor bank accounts, update passwords and be cautious about unexpected contact claiming to be from trusted organisations.
No. Registering simply means you’ll receive updates. If a law firm later takes on the case, you’ll be given the option to learn more about the process and any potential costs before deciding whether to take part.
We are not a law firm. Our role is to keep people informed about potential group actions if one of our regulated UK partner law firms is able to take this claim forward.
A group action claim allows people affected by the same issue to take action together. This strength in numbers helps stand up to big organisations. Join the Claim helps connect people with law firms so these actions have a real impact.
No. You are free to contact a solicitor directly at any time if you would like legal advice or wish to explore a claim.
When you register your interest with Join the Claim, we’ll keep you updated if one of our regulated partner law firms decides to take the claim forward. However, other law firms may also investigate or pursue claims independently of Join the Claim.
Registering for updates does not prevent you from speaking to another law firm or joining a claim elsewhere.
May 2026
The ICO fined the UK water company £963,900 over the major customer data breach.
February 2025
Responding to a Freedom of Information request, the ICO said: "the investigation into this matter is still ongoing and has not yet been completed so there is no information held about the outcome or findings of the investigation".
February 2024
One Manchester-based law firm said it had signed up almost 1,000 claimants to a South Staffordshire Water data breach lawsuit.
January 2023
South Staffs Water and Cambridge Water sent out letters to more affected customers.
November 2022
A statement confirmed that the investigation into the incident had uncovered unauthorised access to some customer’s personal data. The company began contacting affected customers informing them of the data breach and the potential risk.
August 2022
The water company released a statement confirming that had been hit by a criminal cyber-attack. The company also launched an investigation to understand what had happened.
July 2022
South Staffordshire PLC, the parent company of South Staffordshire Water and Cambridge Water discovered it was the victim of a cyber-attack.
We’ll provide more updates on this case as they happen.
If you are a South Staffordshire customer or employee, your personal and financial information may have been stolen. Register to stay updated, and we’ll let you know if a partner law firm takes this claim forward.
LatestSouth Staffordshire Water data breach news
We connect consumers with their legal dream teams to ensure they get the compensation and support they deserve.
Join the Claim is not a law firm. We connect individuals with top law firms for group or individual claims, and our service is free to use. While we may receive a fee from the law firms we introduce you to, this will not affect your costs or compensation. We are not responsible for the advice or services provided by these firms. Please note, nothing on this website is legal advice, and while we check claim eligibility, we cannot guarantee a law firm will accept a case.
Join the Claim is a trading name of Join the Claim Limited, authorised and regulated by the Financial Conduct Authority (FRN: 1053404). Registered in England and Wales, Company No: 16245278. Registered office: 32 Eyre Street, Sheffield, S1 4QZ.
© Join the Claim All Rights Reserved |
