The ICO has fined South Staffordshire Plc and South Staffordshire Water Plc close to £1m after a major cyber attack.
This fine followed a phishing email which installed malware that remained undetected for almost 2 years. This eventually resulted in over 4.1 terabytes of data (including contact details, HR information, financial information and some special category data) being published on the dark web, affecting almost 634,000 people.
The ICO noted the following failings:
- Limited controls to prevent the attacker escalating to administrative privileges
- Inadequate monitoring and logging
- Use of obsolete, unsupported software
- Inadequate vulnerability management
The ICO stated that “proactive security is a legal requirement, not an optional extra.”
For full details and to see the ICO’s security guidance, click here.
