Loading story…
The U.K. Information Commissioner’s Office fined South Staffordshire Water’s parent company £963,900 after finding that the Cl0p ransomware group gained access through a phishing email in September 2020 and remained inside the network for about 20 months. The intrusion was discovered only in July 2022 after IT performance issues prompted an internal investigation, which later uncovered a ransom note and the publication of roughly 4.1 TB of stolen data on the dark web affecting 633,887 customers and employees.
The ICO said the breach was enabled by multiple basic security failures, including weak least-privilege controls, limited monitoring, poor vulnerability management, unsupported systems such as Windows Server 2003, and unpatched domain controllers vulnerable to ZeroLogon. Investigators found the attackers moved laterally using a domain administrator account and accessed highly sensitive personal and financial data, including National Insurance numbers and Priority Services Register information that could reveal disabilities; while Cl0p made claims about water supply manipulation, the regulator said its notice did not identify any compromise of operational or water treatment systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-11, the U.K. Information Commissioner's Office announced a £963,900 fine after concluding the breach was enabled by multiple security failings. The regulator said the penalty was reduced by 40% because the company admitted liability early and agreed to settle without appeal.
In August 2022, attackers published about 4.1 terabytes of stolen data on the dark web. The exposed information affected 633,887 people, including customers and employees, and included sensitive personal and financial data such as National Insurance numbers and Priority Services Register information.
In July 2022, IT performance problems prompted an internal investigation that uncovered the attackers' presence in the network after roughly 20 months. The company also later found a ransom note tied to the intrusion.
After the initial breach, the intruders moved laterally using a domain administrator account and exploited the ZeroLogon vulnerability to escalate privileges. The ICO later said weak privilege controls, poor monitoring, outdated systems, and inadequate vulnerability management enabled the prolonged compromise.
In September 2020, an employee opened a malicious attachment from a phishing email, allowing attackers to install malware and gain access to South Staffordshire Water's parent company network.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceenterprisetimes.co.uk
Open sourcebleepingcomputer.com
Open sourceico.org.uk
Open sourcehelpnetsecurity.com
Open sourceteiss.co.uk
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK Information Commissioner’s Office fined South Staffordshire Water **£963,900** after a ransomware-linked breach tied to the **Cl0p** group exposed personal data from **633,887** customers and employees. Investigators said the intrusion began in **September 2020** with a phishing email that deployed **Get2Loader** and the **SDBBOT** backdoor, allowing attackers to remain inside the utility’s network until **July 2022**, when staff began investigating IT performance problems. South Staffordshire Water later found that **4.1 TB** of data had been exfiltrated and that the stolen information was published on Cl0p’s Tor leak site in **August 2022**. The ICO said the breach was enabled by major security failures across the organization’s environment, including an outsourced SOC with visibility into only **5%** of the network, no internal or external vulnerability scanning for **18 months**, legacy **Windows Server 2003** systems, and unpatched domain controllers exposed to **ZeroLogon** (`CVE-2020-1472`). The case underscores how weak monitoring, patching, and vulnerability management left a UK critical national infrastructure provider vulnerable to a prolonged compromise without requiring especially sophisticated attacker tradecraft.
Jun 29, 2026
The Cl0p extortion group exploited multiple critical SQL injection flaws in Progress Software's MOVEit Transfer platform, beginning with the zero-day later tracked as `CVE-2023-34362`, to breach organizations worldwide and steal large volumes of data. Researchers and government agencies linked the campaign to Cl0p, also tracked as Lace Tempest, `FIN11`, and `TA505`, and reported that attackers often deployed the **LemurLoot** web shell and exfiltrated files within minutes; in some cases, the malware could also pull Azure Blob storage details and credentials from MOVEit settings. Progress disclosed and patched additional MOVEit vulnerabilities, including `CVE-2023-35036` and `CVE-2023-35708`, as incident responders warned that victim counts would continue to rise through delayed breach notifications and downstream third-party exposure. The fallout spread across government, finance, healthcare, education, insurance, professional services, and major global brands, with disclosures naming entities such as EY, PwC, Sony and Pan-American Life Insurance Group among the affected organizations or reported victims. By later tallies, the campaign had compromised thousands of organizations and tens of millions of individuals, while Cl0p shifted from encryption to **data-theft and extortion**, publishing stolen information from nonpaying victims on leak sites. The incident triggered broad regulatory scrutiny, lawsuits, response costs, and supply-chain consequences as organizations discovered that exposure often came through vendors and file-transfer partners rather than direct compromise.
Jul 2, 2026
A UK local authority disclosed personal data during its complaints-handling process after forwarding complaints to a councillor with **all complainants’ identifying details** included, despite some complainants opting to withhold their names. The information reportedly exposed included sensitive contact details (e.g., home addresses, email addresses, phone numbers) that would not normally be shared with the subject of a complaint, raising a **data protection breach** and governance concerns around how complaint records are processed and redacted. Separately, the UK **Information Commissioner’s Office (ICO)** won a court battle in its long-running attempt to uphold a **£500,000 fine** against **DSG Retail** (owner of *Currys PC World* and *Dixons Travel*) tied to a major 2017 breach in which malware was installed on **5,390 point-of-sale tills** and remained undetected for **nine months**. The incident involved theft of **5.6 million payment card numbers and expiry dates** (without cardholder names) and personal data relating to roughly **14 million individuals**; a central legal dispute is whether the payment card data alone constitutes **personal data** under the applicable pre-GDPR regime. A third item argues for using **tax incentives** (modeled on green-energy policy) to drive “security by design” and improve cybersecurity outcomes, but it is a policy opinion piece rather than reporting on a specific incident or enforcement action.
Jun 29, 2026