Phishing victims South Staffordshire fined almost £1 million for major data breach

Phishing remains the most prevalent form of cyberattack, with 38% of businesses falling victim to the scams in 2025. But what happens if your business’ data is exposed by malicious hackers?

Earlier this year, the Information Commissioner’s Office (ICO) issued South Staffordshire Plc and South Staffordshire Water Plc (together ‘South Staffordshire’) a fine of almost £1 million after a major cyber-attack and associated data breach.

In this article, associate solicitor Rhiannon Hastings considers what led to South Staffordshire's data breach, the ICO’s investigation into it and what South Staffordshire and other businesses should do to effectively protect their data and mitigate cyber threats in the future.

How easily can phishing emails lead to a data breach?

In 2020, South Staffordshire fell victim to a malicious phishing email, which, once opened, allowed the attackers to infiltrate the organisation's systems. Almost two years later, in May 2022, having been undetected, the attackers began to compromise South Staffordshire’s system by granting themselves domain administrator privileges – the highest level of access to South Staffordshire’s IT network.

It was not until July 2022 that the breach was identified and an internal investigation commenced. Towards the end of July 2022, South Staffordshire reported a personal data breach to the ICO and two days later, discovered a ransom note from the hackers.

Unfortunately, despite the breach being identified, the attack on South Staffordshire’s network was successful and the personal information (including addresses, dates of birth, telephone numbers, national insurance numbers, passwords and bank account details) of 633,887 people, ranging from current and former customers to current and former employees, was published to the dark web. The case, unfortunately, illustrates how simple it is for skilled attackers to access private data through phishing scams, and further highlights the need for businesses to have robust protection in place.

Can my business be fined for falling victim to phishing scams?

The most frustrating part of being conned by a phishing email is that your business can quite literally pay the price if the ICO finds that your data wasn’t adequately secure under UK data protection law.

In 2022, the ICO launched an investigation into South Staffordshire that ultimately found they had failed to implement appropriate security controls as required under UK data protection law.

More specifically, the ICO concluded that South Staffordshire:

• Had insufficient controls in place - the attacker was able to escalate administrator privileges after gaining a foothold within South Staffordshire’s network
• Had inadequate processes in place for monitoring their IT systems and logging threats - the malicious activity was not detected
• Used obsolete, unsupported software on some devices
• Had insufficient vulnerability management measures in place, including a lack of regular internal and external security scans

Following the conclusion of its investigation, the ICO informed South Staffordshire that it had identified several failings and that it intended to fine them.

On the other hand, the ICO recognised that South Staffordshire had been cooperative throughout its investigation and admitted its failings early on, as well as outlining steps it intended to take going forward to prevent any reoccurences. As a result, the ICO applied a 40% reduction to the fine it had initially intended to impose, resulting in South Staffordshire having to pay £963,900.

How can I ensure my business is protected against data breaches?

The outcome of the ICO’s investigation and the significant fine imposed on South Staffordshire serve as a cautionary tale for all businesses and reiterate that the ICO has high expectations of businesses in relation to cybersecurity and resilience.

Businesses should consider whether:

• They have adequate controls in place to ensure that only those who need to access certain data are authorised to do so and that they do not have access to any more information than necessary
• They have suitable logging and monitoring controls in place in order to identify and manage threats early on
• Staff are properly trained to identify and deal with threats
• They are regularly updating their software and ensuring that they are using compatible devices
• They are deploying regular internal and external scanning in order to identify threats and system compromises

For guidance on how to mitigate data breaches from occurring in your business, or data protection advice more generally, please contact Rhiannon Hastings, data protection solicitor in our commercial team, on [email protected] or 0191 211 7891.