Southern Water customer data was taken in ransomware attack

Good practice

Javvad Malik, lead security awareness advocate at KnowBe4, said Southern Water’s response set a good example of best practice for others to follow.

“The fact that they’ve initiated steps such as notifying affected individuals and collaborating with government and regulatory bodies showcases an adherence to best practices in incident response,” said Malik.

“However, the response does not stop there. The threat of the stolen data being weaponised to use against employees, customers, and third parties remains high, so people should be provided clear instructions and make it easy for them to implement it to better safeguard themselves in the future."

Lucky escape?

The UK authorities, and their counterparts in the US, are highly alarmed by the prospect of cyber attacks against operators of critical national infrastructure (CNI), which includes utilities such as Southern Water.

Such organisations are valuable targets for both financially motivated attackers such as ransomware gangs, which know they hold vast stores of useful data and are incentivised to pay to avoid service disruption, and state-sponsored attackers, which can leverage the disruption in the service of their governments’ goals.

The nightmare scenario in such an attack would be disruption to water supplies, or an incident in which the chemical content of water was altered to cause harm.

Such attacks do happen. A December 2023 attack on a small supplier in Ireland cut off services to multiple customers; while an attack on a Florida facility in February 2021 came close to poisoning a small town by increasing the lye (sodium hydroxide) content of the water supply, but this was averted by an eagle-eyed plant worker.

As such, Southern Water may have had a relatively lucky escape, as Black Basta’s goal seems to have been data theft and extortion, as Ryan McConechy, chief technology officer at Barrier Networks, observed.

“This attack against Southern Water demonstrated how vulnerable critical national infrastructure is to hacking today. Fortunately, in this case it was only data that was compromised, had the attackers gained access to the operational controls running the utility, the outcome could have been very different,” he said. 

“But this doesn’t make light of the situation because criminals now have access to sensitive customer data, which exposes them to both financial and identity fraud.”