South Staffs Water: Cyber-attack

Motion made, and Question proposed, That this House do now adjourn.—(Andrew Stephenson.)

Thank you, Mr Deputy Speaker, for allowing this Adjournment debate.

In July this year, South Staffordshire PLC, the parent company of both South Staffs Water and Cambridge Water, experienced a criminal cyber-attack. The incident involved the theft of data from its IT systems. Following the incident, it found evidence that some of its staff and customer data had been accessed. With investigations still ongoing, it has now been confirmed that at least 249,000 customers who pay by direct debit—pretty much all of my Dudley North constituents and myself included—have now seen their personal contact and banking details available on the dark web.

The incident took place in July this year, and customers have only in recent weeks been made aware of the real scale of the damage. I did meet virtually with the South Staffs team yesterday, ahead of this evening’s debate. To their credit, they are seemingly taking the issue much more seriously than initially perceived. It is clear that no business wants to harm its customers or be the victim of a cyber-attack.

I, too, have constituents who have been affected by this issue. I am a South Staffs Water customer myself, although my bank account details have not been breached. Does my hon. Friend agree that we must be concerned about the amount of time that it has taken between this issue being apparently found out by South Staffordshire PLC and customers being informed? I sincerely hope that South Staffordshire is able to reassure its customers that, when it comes to data, it will continue to take this matter incredibly seriously and do all it can to rectify the matter and continue to protect both my hon. Friend’s constituents and mine.

My right hon. Friend is correct. In fact, one aspect of the conversation that I had with the chief executive of South Staffordshire PLC was to challenge that very point. The response was that, at the time of the cyber-attack, it was not aware of the damage that had been caused and how extensive it might have been. It has taken time for it to understand the extent of what had happened. Then it had to respond within a certain timeframe under a duty to its customers. I have to say that it does feel like a long time, and, of course, during that time we have seen what has happened to customers’ data.

As I was saying a few moments ago, it is clear that no business wants to harm its customers or be victims of a cyber-attack, particularly those with a proven long and positive relationship with their customers, as in fact South Staffs Water does have. Not only were cyber-defences not strong enough, but I have been clear, and the company recognises, that the communications and response from the company were not as appropriate or as user-friendly as many of us would and should have expected.

I, too, was a victim of this situation as a Cambridge Water customer. On the communications point, it was lengthy and detailed, but for many customers I suspect it was intimidating. Does the hon. Gentleman agree that it would be better if the company had just said, “There is a problem. You can find out more here, but don’t worry, whatever happens, we will sort it out for you”?

The hon. Member is right, although I would not want to oversimplify the extent of the problem. The company has acknowledged that the response was not appropriate. It has accepted the critique and a number of the suggestions I made, and on the back of that, it has committed to making some improvements. I have yet to hear what those improvements will look like, but he is correct in what he says. Given the spectrum of customers that the company serves, we also need to think about tailored responses to different people, given the predicaments some of them may be in.

Several constituents have reached out to me with real anxieties and concerns, as have other Members. Picture this, if you will, Mr Deputy Speaker. You are an elderly resident with little or no access to IT or no IT literacy, and you have just received a six-page letter with instructions you are unable to deal with. It is a long and complicated letter—with very small font, I might add; something that even I would struggle with—with important information hidden several pages deep. You establish in the first page that your banking details and other personal details have been sold on a wholly unlawful area on the internet known as the dark web. You are told that criminals might take large sums of money from your accounts. Furthermore, upon reading the reams of prose, you find out you can only seek to protect yourself on the internet—something you might not even have access to. You may also be a vulnerable customer who perhaps receives care support in independent settings, but be wholly unprepared and unable to deal with something this complicated and even alien to the life you experience daily.

My hon. Friend has mentioned those who do not have access to internet or emails. I contacted South Staffs Water—I, too, have constituents affected by this cyber-attack—and it advised that these constituents would need to apply for paper copies of their records from three different credit reference agencies, and they would also need to verify their identity first. Does he agree that this will cause a considerable amount of work for those in these situations, particularly as they will presumably have to do this regularly to ensure they have up-to-date records?

My hon. Friend is right. All I can say is that the situation is clearly unacceptable, and the senior management team at the company now agree that their initial response was not adequate or appropriate. They physically have not had the time to address these concerns yet, but we should all be looking on behalf of our constituents to ensure that their response takes on board all these considerations.

Picturing yourself again as this vulnerable customer, Mr Deputy Speaker, you are then advised that to secure your data, you should register with another organisation called CIFAS—this was one of the things mentioned in the letter—at an additional personal cost, it was suggested by the company, of £25 a year. You are asked to then release yet more personal data on to the internet. That angered me somewhat, and it was one of the first things I mentioned to the chief executive. Their immediate response was, “We have withdrawn that. We are writing again to customers, and we have removed that, as it has created confusion. We should not have done it”, and that is part of the package that the company will be coming back with in support of its customers.

When a data breach such as this has happened, one cannot simply let it go, because it can affect credit ratings, which can in turn affect an individual’s ability to apply for credit, whether a loan, credit card, mortgage or even a mobile phone contract. It could lead to a household finding itself unable to pay for household bills, groceries, electricity or heating. Should the worst happen, a data breach could lead to an individual or family finding themselves severely impoverished through no fault of their own—that point must be emphasised.

I know that I would panic and be extremely anxious, and I am sure that you would be as well, Mr Deputy Speaker, should you have found yourself in such a situation. As many of us in the House will know, good, easy to read and user-friendly communications are vital for keeping our constituents informed and with peace of mind. That is why, after I met South Staffs Water, it acknowledged shortcomings in its initial communications with its customers, and I am assured at this point that it is taking serious steps to mitigate the anxiety caused and ensuring that its customers are supported. I have also asked it to make special arrangements—I do not know yet what they will look like—to reach out to some of those more vulnerable customer groups that I mentioned.

I thank my hon. Friend the Member for Dudley North (Marco Longhi) for securing the debate and bringing attention to an important, serious issue that has been worrying a number of his constituents as well as constituents of those hon. Members who made contributions: my right hon. Friend the Member for Aldridge-Brownhills (Wendy Morton), my hon. Friend the Member for Burton (Kate Kniveton) and the hon. Member for Cambridge (Daniel Zeichner). Although my hon. Friend the Member for Dudley South (Mike Wood) cannot speak as he is a Government Whip, I know that he has also been active in contacting his affected constituents.

While cyber-resilience in the water sector is the responsibility of the Secretary of State for Environment, Food and Rural Affairs, I am responding as the Department for Digital, Culture, Media and Sport has responsibility for data protection and cyber-resilience for the wider economy—I know that you were wondering, Mr Deputy Speaker, why I was here once again. The threat to the UK from cyber-attacks is on the increase as evidenced by the sharp rise in ransomware attacks that British companies have suffered in the last few years. Cyber-criminals are increasingly seeing ransomware as a profitable business. The Government are committed to addressing that issue, as evidenced by the national cyber strategy that was published in December 2021.

As my hon. Friend the Member for Dudley North highlighted, in August, South Staffordshire plc—the parent company of South Staffs Water and Cambridge Water—was hit by a cyber-attack that resulted in data extortion and ransom. The criminals also exfiltrated information from the company and attempted to extort it for their own financial gains. The National Cyber Security Centre, which is a part of GCHQ, alongside UK law enforcement and the Department for Environment, Food and Rural Affairs, offered support to South Staffs Water and its incident response provider. In particular, the NCSC’s technical experts offered tactical and strategic guidance on how to effectively respond to and recover from the incident. DEFRA, which is responsible for the security and resilience of the water sector, also responded quickly and worked with South Staffs Water to understand the potential impact, provide business continuity advice and help it with notification requirements.