Hundreds of thousands of Southern Water customers and current and former employees may have had their personal information compromised in a major cyberattack.
The attack took place in late 2023 and became public in January 2024. But what information was involved, how do you know if you were affected and could you make a compensation claim?
Here are the answers to some of the most common questions we have been asked about the Southern Water data breach.
What happened in the Southern Water data breach?
Southern Water suffered a cyberattack in December 2023 in which criminals gained access to part of its IT systems and stole company data. The company became aware that it had been named by cybercriminals on 22 January 2024 and launched an investigation with independent cybersecurity specialists.
Southern Water says the attack affected a corporate file-sharing system rather than the technology used to supply water or provide wastewater services. Its operations were not disrupted.
The Black Basta ransomware group was widely reported to have claimed responsibility for the attack.
How many people were affected?
Southern Water has said it notified around 5% to 10% of its customer base, as well as all current employees and some former employees. That means hundreds of thousands of people may have been affected.
The company says everyone it identified as having potentially compromised personal information has now been contacted.
What information was compromised?
The information affected varied from person to person.
For some customers, potentially compromised information included:
- Names
- Dates of birth
- National Insurance numbers, where held
- Bank account numbers
- Sort codes
- Customer reference numbers.
For current and former employees, affected information may also have included HR records and identity documents, such as passports, driving licences or utility bills.
Not everybody affected will have had all of these types of information compromised.
Was the stolen Southern Water data published online?
Southern Water says it has found no evidence that the compromised personal information was made available online beyond a small number of screenshots initially posted by the cybercriminals.
That does not change the fact that information was accessed and stolen, but it is an important distinction when considering what happened after the attack.
Southern Water says its investigation into the cyber incident is now complete and that it continues to monitor its systems for suspicious activity.
How do I know if I was affected?
Southern Water says it contacted the individuals whose personal information it identified as potentially compromised. So, if you received a letter or other notification from Southern Water telling you that your data was affected, you may be able to explore a compensation claim.
If you were a customer or employee at the time but never received a notification, that does not necessarily confirm whether your information was involved.
You can contact Southern Water if you want to check what information it holds about the incident and your data.
Can I claim compensation for the Southern Water data breach?
Potentially. UK data protection law allows people to seek compensation in certain circumstances where a breach of data protection law causes them financial loss or distress.
Being involved in a data breach does not automatically mean you will receive compensation. Whether you have a valid claim will depend on factors including what happened to your personal information, whether there was a breach of data protection law and what impact the incident had on you.
Do I need to have lost money to make a claim?
Not necessarily. Data protection compensation can potentially cover both financial loss and distress caused by a breach.
That means a claim does not always depend on money having been stolen from your bank account or somebody using your identity.
However, you would still need to establish that you have a valid legal claim.
What if my data hasn't been misused?
You may still be able to explore a claim. Actual fraud or identity theft is not necessarily required before a data breach compensation claim can be considered.
For example, the impact of a breach can sometimes include distress about sensitive information being accessed or concerns about what could happen to it. Whether that is enough to justify compensation will depend on the individual circumstances.
Is the ICO investigating Southern Water?
Yes. Southern Water reported the incident to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. The ICO confirmed in October 2025 that its investigation into the cyber incident was still ongoing.
A regulatory investigation is separate from an individual compensation claim. The ICO can investigate whether data protection law was followed and take enforcement action where appropriate, but it does not award compensation to people affected by a breach.
How much Southern Water data breach compensation could I receive?
There is no standard compensation figure for the Southern Water data breach.
Any amount would depend on the individual circumstances of the claim, including the information involved and the effect the breach had on the person affected.
You should therefore be cautious about anyone guaranteeing a particular payout before your circumstances have been properly assessed.
What should I do if I think I was affected?
Keep any letters or emails Southern Water sent you about the breach, as these may help establish what information was involved.
It is also sensible to remain alert for suspicious emails, calls or activity on your financial accounts. If you believe your bank details have been misused, contact your bank straight away.
If Southern Water confirmed that your personal information was compromised, you can also check whether you could be eligible to make a data breach compensation claim.
Our eligibility checker takes just a few minutes. If you qualify and choose to continue, we’ll show you the regulated UK law firm that can handle your claim before your details are shared.
Join the Claim connects consumers with SRA-regulated lawyers. Visit the claim page to check your eligibility if a claim is open with one of our trusted legal partners. If a group action has not yet been launched, you can register your interest and we’ll keep you informed if a partner firm decides to take a claim forward.
