Cambridge Water customers’ bank details published to dark web after cyber attack

Bank account details of Cambridge Water customers have been published to the dark web, following a cyber attack.

Customers have been left alarmed and furious after learning that names and current addresses, sort codes and account numbers are among the data stolen by cyber criminals from its parent company, South Staffordshire plc, back in August.

Cambridge Water has written to customers to warn them that “criminals may try to use this compromised data to carry out fraud, in particular by submitting fraudulent Direct Debit mandates to your bank or building society using the data compromised in the cyber-attack”.

Andy Willicott, managing director of Cambridge Water, said in a statement: “We understand that customers trust us to keep their data safe and I’d personally like to say sorry to all those customers impacted – we’ll be doing what we can to support you through this.”

The company has set up a helpline for customers, from 8am to 6pm on weekdays and offered customers access to free credit monitoring for a year.

The customers affected are understood to be some of those who pay by Direct Debit.

Cambridge Water has told customers that its parent company took “immediate steps to manage and respond” to the cyber attack once it had been identified.

That, however, was too late to prevent the data breach.

Customers have been told that South Staffordshire plc “engaged leading IT forensic experts to investigate the issue and also notified the National Cyber Criminal Security Centre, the National Crime Agency, the Information Commissioner’s Office (ICO), Ofwat and the Consumer Council for Water as well as the Drinking Water Inspectorate”.

Some customers took to social media to express anger that there was “barely an apology” from Cambridge Water in the letter they received from the managing director.

In it, he says: “We regret the concern this may cause you and will do all we can to support you.”

There has also been concern from customers about the length of time taken to notify them what data had been stolen and published, given that the attack happened in the summer.

One customer told the company on Twitter: “It’s absolutely disgraceful that customers are only finding out about this data breach (and that out details are now on the dark web) four months afterwards.”

Mr Willicott said: “We have been working with external specialists to understand exactly what data has been published. This is a complex and time intensive process.”

Meanwhile, Cambridge Water’s website appeared to be down on Saturday evening (December 3).

Affected customers are urged by the company to register for the free credit monitoring service on offer, and to check their bank and building society statements carefully and promptly, and to act swiftly if they spot any transactions they do not recognise.

Cambridge Water added in a statement: “Our investigation into the incident continues and if we establish that other customers need to take action we will, of course, let them know as soon as possible. We are also working closely with the police and with the relevant government and regulatory authorities and are keeping them updated.”

Cambridge Water has not yet divulged how many customers were affected, but said any who do not receive a letter do not need to take any action.

“We will continue to invest in protecting our customers, our systems, and our data,” said Mr Willicott.

“We continue to supply safe water to all of our Cambridge Water customers. Our customer service, operations and maintenance teams also continue to operate as usual.”

The company supplies water to about 350,000 people in an area of Cambridgeshire that stretches from Cambridge to Ramsey in the north, Gamlingay in the west, Balsham in the east and Melbourn in the south.

For more information and support, visit cambridge-water.co.uk/support or call the helpline on 0800 169 8355 between 8am and 6pm on weekdays.