Poor security left hackers inside water company network for nearly two years

The ICO fined South Staffordshire Water £963,900 after a phishing-initiated intrusion (Sept 2020–July 2022) that installed malware, led to administrator privilege compromise, and resulted in 4.1 TB of personal data (approximately 633,887 people) being published on the dark web; the regulator cited weak controls, only 5% monitoring coverage, unsupported Windows Server 2003, and poor patching and vulnerability management.