Monetary penalties · Utilities
South Staffordshire Plc and South Staffordshire Water Plc
£963,900penalty
Root cause
Cyber attack
An external attacker got in and took data. Where the ICO's notice names the specific failure that let them, the case is filed under that instead.
What happened
The Information Commissioner’s Office (ICO) has imposed a fine of £963,900 on South Staffordshire Plc & South Staffordshire Water Plc for the infringement of Article 5(1)(f) and Article 32(1) of the UK General Data Protection Regulation. This enforcement action follows a cyber incident in which personal data relating to approximately 633,887 UK data subjects was exfiltrated.
Summarised from the notice published by the ICO on 7 May 2026. Read the original notice — it is the authoritative version.