Loading story…
The UK Information Commissioner’s Office fined South Staffordshire Water £963,900 after a ransomware-linked breach tied to the Cl0p group exposed personal data from 633,887 customers and employees. Investigators said the intrusion began in September 2020 with a phishing email that deployed Get2Loader and the SDBBOT backdoor, allowing attackers to remain inside the utility’s network until July 2022, when staff began investigating IT performance problems. South Staffordshire Water later found that 4.1 TB of data had been exfiltrated and that the stolen information was published on Cl0p’s Tor leak site in August 2022.
The ICO said the breach was enabled by major security failures across the organization’s environment, including an outsourced SOC with visibility into only 5% of the network, no internal or external vulnerability scanning for 18 months, legacy Windows Server 2003 systems, and unpatched domain controllers exposed to ZeroLogon (CVE-2020-1472). The case underscores how weak monitoring, patching, and vulnerability management left a UK critical national infrastructure provider vulnerable to a prolonged compromise without requiring especially sophisticated attacker tradecraft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-11, the UK Information Commissioner's Office fined South Staffordshire Water £963,900 for the ransomware-related data breach. The ICO cited major security failings including poor network visibility, lack of vulnerability scanning, legacy systems, and unpatched ZeroLogon-vulnerable domain controllers.
On 2026-04-23, South Staffordshire Plc and South Staffordshire Water Plc entered into a voluntary settlement with the UK ICO, admitting UK GDPR infringements tied to the Cl0p-related breach. The companies accepted a 40% discount on the monetary penalty and agreed not to appeal the notice.
On 2022-08-18, reports initially linking a ransomware incident to Thames Water were corrected after Thames Water denied being affected and Cl0p updated its leak site to name South Staffordshire Plc instead. South Staffordshire said the attack impacted only its corporate IT network and did not disrupt water supply or operational systems.
In August 2022, personal data belonging to 633,887 customers and employees was published on Cl0p's Tor leak site. South Staffordshire Water later determined that 4.1 terabytes of data had been exfiltrated.
In July 2022, South Staffordshire Water uncovered the intrusion while investigating IT performance problems. The attackers had remained undetected in the environment for nearly two years.
In September 2020, attackers gained initial access to South Staffordshire Water through a phishing email. The intrusion deployed Get2Loader and the SDBBOT backdoor, beginning a long-running compromise later tied to the Cl0p group.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcebleepingcomputer.com
Open sourcetheregister.com
Open sourceblog.bushidotoken.net
Open sourcetheregister.com
Open sourcebleepingcomputer.com
Open sourceico.org.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.K. Information Commissioner’s Office fined South Staffordshire Water’s parent company **£963,900** after finding that the **Cl0p** ransomware group gained access through a phishing email in September 2020 and remained inside the network for about 20 months. The intrusion was discovered only in July 2022 after IT performance issues prompted an internal investigation, which later uncovered a ransom note and the publication of roughly **4.1 TB** of stolen data on the dark web affecting **633,887** customers and employees. The ICO said the breach was enabled by multiple basic security failures, including weak least-privilege controls, limited monitoring, poor vulnerability management, unsupported systems such as **Windows Server 2003**, and unpatched domain controllers vulnerable to **`ZeroLogon`**. Investigators found the attackers moved laterally using a domain administrator account and accessed highly sensitive personal and financial data, including National Insurance numbers and Priority Services Register information that could reveal disabilities; while Cl0p made claims about water supply manipulation, the regulator said its notice did not identify any compromise of operational or water treatment systems.
Jun 29, 2026
The Cl0p extortion group exploited multiple critical SQL injection flaws in Progress Software's MOVEit Transfer platform, beginning with the zero-day later tracked as `CVE-2023-34362`, to breach organizations worldwide and steal large volumes of data. Researchers and government agencies linked the campaign to Cl0p, also tracked as Lace Tempest, `FIN11`, and `TA505`, and reported that attackers often deployed the **LemurLoot** web shell and exfiltrated files within minutes; in some cases, the malware could also pull Azure Blob storage details and credentials from MOVEit settings. Progress disclosed and patched additional MOVEit vulnerabilities, including `CVE-2023-35036` and `CVE-2023-35708`, as incident responders warned that victim counts would continue to rise through delayed breach notifications and downstream third-party exposure. The fallout spread across government, finance, healthcare, education, insurance, professional services, and major global brands, with disclosures naming entities such as EY, PwC, Sony and Pan-American Life Insurance Group among the affected organizations or reported victims. By later tallies, the campaign had compromised thousands of organizations and tens of millions of individuals, while Cl0p shifted from encryption to **data-theft and extortion**, publishing stolen information from nonpaying victims on leak sites. The incident triggered broad regulatory scrutiny, lawsuits, response costs, and supply-chain consequences as organizations discovered that exposure often came through vendors and file-transfer partners rather than direct compromise.
Jul 2, 2026
Poland disclosed cyberattacks on five water treatment plants after intruders breached industrial control systems and, in some cases, gained the ability to change settings for pumps, alarms, and treatment equipment. Investigators said the compromises were enabled by basic security failures, including weak passwords and internet-exposed systems, and Polish authorities linked parts of the activity to Russian-aligned actors seeking to disrupt public services and probe infrastructure resilience. The incidents echo the earlier intrusion at a Florida water plant, where attackers reportedly exploited outdated software and poor password practices to gain access to operational systems. Together, the cases underscore a persistent risk across municipal water utilities: insecure remote access, exposed human-machine interfaces, aging control technology, and weak authentication can turn preventable weaknesses into threats to service continuity and public safety.
Jun 29, 2026