Southern Water cyberattack expected to hit hundreds of thousands of customers
- Reference: 1707914304
- News link: https://www.theregister.co.uk/2024/02/14/southern_water_cyberattack/
- Source link:
This is on top of the undisclosed proportion of current and former staff that are also said to be affected. The company, which provides water and wastewater services to millions of households, will be writing to those whose data was stolen directly in the coming days.
The announcement comes just shy of four weeks after Reg readers were [1]first to know about the intrusion , which was claimed by the Black Basta ransomware group.
[2]
It should be said that Southern Water still hasn't confirmed ransomware was involved in the incident.
[3]
[4]
However, it was fairly evident from the outset that both staff and customers were affected by the data breach. In typical Black Basta fashion, it dumped a plethora of the data it stole online, including identity documents and HR files, among others.
The information revealed in this initial data dump was enough to verify through simple means that the documents were genuine and implicated both customers and employees.
[5]
In a letter sent to customers already, seen by El Reg , Southern Water said names, dates of birth, national insurance numbers, bank account numbers, sort codes, and payment reference numbers may have been stolen. This data was all visible online from the beginning.
It's understood that customers will be sent different versions of the letter depending on the data believed to be stolen. Affected individuals have also been offered a free 12-month Experian Identity Plus membership for credit monitoring.
Per the utility company's website, it provides water services to 2.5 million customers and wastewater services to more than 4.7 million customers. It means that if the quoted 5 percent to 10 percent range is accurate, then hundreds of thousands of customers will potentially be receiving letters from the company soon, informing them that their data was stolen.
[6]
Offering some comfort, Southern Water's latest statement confirmed that the third-party investigators called in to analyze the incident found no new evidence that data was further published online.
"We are very sorry that this has happened," the company [7]said .
"Throughout this process we have been working with Government, our regulators, and the National Cyber Security Centre. We have also notified the police and the Information Commissioner's Office.
[8]Bumblebee malware wakes from hibernation, forgets what year it is, attacks with macros
[9]Australian Tax Office probed 150 staff over social media refund scam
[10]Crims found and exploited these two Microsoft bugs before Redmond fixed 'em
[11]Just one bad packet can bring down a vulnerable DNS server thanks to DNSSEC
"Since the incident, our IT security teams have worked with independent incident response experts, using enhanced monitoring and protection tools to check actively for any suspicious activity on our IT estate. Southern Water's operations and services to customers have not been impacted.
"Further updates will be posted on our website and social media channels as we know more. Please be assured that if at any point we have reason to believe your data may be impacted, we will notify you, in line with our regulatory obligations."
At the time of writing, Black Basta appears to have removed its post about Southern Water from its leak blog.
Usually this is only done when a victim [12]pays a ransom . We asked Southern Water about this but it declined to comment.
Critical infrastructure has long been a target for ransomware groups given the severe disruption to civil society an outage could potentially cause.
The water and wastewater sectors have become an increasingly targeted subset of these critical organizations over the past year, an observation that prompted national cybersecurity agencies such as CISA and the [13]UK NCSC to publish advisories highlighting the ongoing threat.
One of the most serious examples recently came in November when a [14]Pennsylvania water authority was attacked by Cyber Aveng3rs , a group experts believe to be Iran-aligned attackers.
Programmable logic controllers were targeted and displayed anti-Israel messaging, which also explained that compromising Israel-manufactured technology would be an ongoing goal for the group.
Now-shuttered Conti also semi-mistakenly [15]claimed an attack on Thames Water in 2022, but actually breached South Staffordshire – parent company of South Staffs Water and Cambridge Water. ®
Get our [16]Tech Resources
[1] https://www.theregister.com/2024/01/23/southern_water_confirms_cyberattack/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZczxvCsy6rWQvqHIi9roNAAAAYg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZczxvCsy6rWQvqHIi9roNAAAAYg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZczxvCsy6rWQvqHIi9roNAAAAYg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZczxvCsy6rWQvqHIi9roNAAAAYg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZczxvCsy6rWQvqHIi9roNAAAAYg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.southernwater.co.uk/customer-update
[8] https://www.theregister.com/2024/02/14/bumblebee_malware_back/
[9] https://www.theregister.com/2024/02/14/ato_operation_protego_tax_scam/
[10] https://www.theregister.com/2024/02/14/patch_tuesday_feb_2024/
[11] https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/
[12] https://www.theregister.com/2023/12/28/casino_ransomware_attacks/
[13] https://www.ncsc.gov.uk/news/ncsc-warns-enduring-significant-threat-to-uks-critical-infrastructure
[14] https://www.theregister.com/2023/11/29/water_authority_ciso_iran/
[15] https://www.theregister.com/2022/08/18/clop_ransomware_uk_water/
[16] https://whitepapers.theregister.com/
Re: As a Southern Water customer*, When they said "Sorry we leaked your shit"...
It was 1989 so yes, during Thatcher's time as PM.
Re: As a Southern Water customer*, When they said "Sorry we leaked your shit"...
I saw no problems in the 50's every time I just walked across the yard and took a shit or a piss in the Thunderbox which helped me start reading because there was always plenty of news papers there.
Re: As a Southern Water customer*, When they said "Sorry we leaked your shit"...
Scottish Water is still in public ownership, and is also under fire for dumping sewage into rivers in ever-increasing quantities.
It's probably the fault of those dastardly English tourists, coming over the border and shitting in Scottish toilets, overloading poor Scottish sewers.
Re: As a Southern Water customer*, When they said "Sorry we leaked your shit"...
Public Ownership as an arms-length quango is different from being government run.
A public owned company is still encouraged to maximise profit, sometimes at the expense of well-run public service. See also: The Post Office
But even government departments can still be scandalously awful, I agree. E.g. the Home Office
Re: As a Southern Water customer*, When they said "Sorry we leaked your shit"...
even government departments
You appear to have misspelled 'especially'. It's easily done.
If the water companies were not in arm-length/private ownership they'd be dumping their sewage selectively in rivers running through opposition party constituencies, while MPs from the governing party would frequently be pictured proudly opening brand new sewage treatment plants in their constituencies.
On this matter I'm sure a moderately serious Offwater wrist slapping is coming Southern Water's way. A stern letter might even get sent.
Re: As a Southern Water customer*, When they said "Sorry we leaked your shit"...
I'm just glad that they've never managed to spell my name right and I've never bothered to correct them :)
Although not heard a peep out of them so maybe I'm OK.
Southern water are pretty useless. On par with SSEN. A house down the road from me was leaking water from the meter pit for about 4 months. When we had the cold weather it turned that part of the road into a skating rink.
Re: As a Southern Water customer*, When they said "Sorry we leaked your shit"...
> A house down the road from me was leaking water from the meter pit for about 4 months.
Which side of the meter was leaking?
Re: As a Southern Water customer*, When they said "Sorry we leaked your shit"...
No idea, I just drove past it twice a day :)
As it was leaking for so long probably not the house side.
Re: As a Southern Water customer*, When they said "Sorry we leaked your shit"...
"Having such a utility in private hands should never have been allowed"
Believe it or not, sewage discharges were far more common before privatisation, and the reason for privatising was so government weren't saddled with costs and work of complying with the upcoming EU Urban Waste Water Treatment Directive, nor the various EU Drinking Water Directives. Back then it was the state owned water boards, and especially in coastal areas the norm was to allow untreated sewage into the sea. In addition to the tightening water treatment regulations, the state had under all parties and for decades limited infrastructure investment and intentionally allowed water treatment facilities and pipes to deteriorate, and didn't want to be on the hook for either the inevitable breaches of standards, or the costs of remediating the state's neglect.
I worked on investment programme management for one of the largest water companies for a good few years immediately after privatisation, anybody who thinks things would be inherently better under state ownership is living in a fantasy land. That said, there's been a failure of regulation over the past few years, where OFWAT should have held companies to the requisite standards, noting that would also require higher water charges. I'm reasonably confident that the ultimate causes of sewage discharges come down to the fact the population has increased by 14% over the past twenty years, but the OFWAT permitted investment programmes haven't created 14% more treatment or pipe capacity. The same is true for rail and road, but we just tolerate the consequences of congestion and delays.
Re: As a Southern Water customer*, When they said "Sorry we leaked your shit"...
> I worked on investment programme management for one of the largest water companies for a good few years immediately after privatisation
Oh, so it's YOUR fault then?!
How come the water companies were allowed to take on loans, and spend the money on dividends and executive salaries, instead of on investment in infrastructure?
They could have built separate sewage and storm drains like they do in Europe. Population increase could have been *planned for*.
But given that they split a large public body into dozens of regional utility companies, joined-up thinking becomes impossible, and the policymaking work becomes inefficient as is has to be repeated in each region, and nobody is going to waste money building a storm drain if the neighbouring utility isn't bothering.
Ofwat is partially responsible for this farce, but that is what you get with a revolving door between a private sector and its regulator..
Re: As a Southern Water customer*, When they said "Sorry we leaked your shit"...
"OFWAT permitted investment programmes"
Quality British government in action, the same kind that created Brutish Leyland
Re: As a Southern Water customer*, When they said "Sorry we leaked your shit"...
> Believe it or not, sewage discharges were far more common before privatisation
You'll forgive me if i say no, i don't believe it, then :)
Do you have a source for that claim?
But of course it was the Thatcher monster
A Tory so blue she was positively ultraviolet!
Re: But of course it was the Thatcher monster
Well, of course there were other monsters around in the circus that was the Thatcher government.
[1]One BBC Radio programme I listened to a while ago said that John Redwood was instrumental in privatising British Gas. He may have done the same for other utilities.
https://en.wikipedia.org/wiki/Water_privatisation_in_England_and_Wales
The Conservative government of the day had originally proposed water privatisation in 1984 and again in 1986, but strong public feeling against the proposals led to plans being shelved to prevent the issue influencing the 1987 general election.[15][16] Having won the election, the privatisation plan was "resurrected and implemented rapidly"
So it seems little has changed in UK politics. Always implement your most evil and unpopular plans immediately after an election.
[1] https://www.bbc.co.uk/sounds/play/m001j3lj
Same old zero liability
"Affected individuals have also been offered a free 12-month Experian Identity Plus membership for credit monitoring."
12 months? That data is leaked for ever . The victims will always be vulnerable.
Experian Identity Plus is expensive if you buy it. Victims will need to keep paying after a year, and so the membership for these leaks should be perpetual.
Once these companies start factoring the cost of lifetime Experian membership for all victims, they may spend more than the 50p they currently do on security.
As a Southern Water customer*, When they said "Sorry we leaked your shit"...
... I thought they meant it would be floating out to sea. Or polluting a nice chalk stream fishery, or washing up on a sandy beach somewhere.
Now i learn it's all over the bloody Internet too!
* not by choice, of course. As a Public Utility, they have a monopoly on the whole area that they serve. Having such a utility in private hands should never have been allowed. On which ex politician can I place the blame for that? One Margaret Thatcher i would assume