Southern Water Data Breach: How to Find Out What Was Taken

Southern Water says it was named on a criminal group’s site on 22 January 2024 and issued a statement the next day. On 12 February 2024 it announced that “data from a limited part of Southern Water’s server estate had been stolen and was at risk following an illegal intrusion into our IT systems”. Its annual reports put the attack itself in late 2023.

It said it was notifying “in the order of 5 to 10 percent of our customer base”, and “all of our current employees and some former employees”. In October 2024 it said its investigation had concluded and it was taking any remaining steps to notify people. It reports that water and sewerage services were not affected.

Southern Water’s public statements do not say which kinds of personal data were stolen, and the ICO’s published letter is redacted at that point. Lists you may have seen elsewhere come from press reports, not from Southern Water or the ICO, so we do not repeat them.

For a sense of what a request could turn up, its household privacy notice lists what it generally holds about customers: contact details and date of birth, bank and credit details, other named account holders, and — for people on its Priority Services register — some health information. That is what it holds in general, not a list of what was taken.

Your own letter may have said more about your data specifically. If it did not, a subject access request gets you a copy of what Southern Water holds about you, and the breach question asks which of it was involved. Only the copy is a legal duty; see what a request does and does not get you.

Southern Water offered the people it wrote to “enhanced Experian credit monitoring, free of charge, for the next 12 months”, activated with a code printed in the letter. The letters went out from February 2024, and the remaining notifications around October 2024, so for most people that year has passed. Southern Water has not published a closing date.

The general steps after a breach — checking your bank statements and credit report, and being wary of unexpected calls — are on the data breach page.

Southern Water reported the attack to the ICO. On 16 December 2025 the ICO wrote to it that it had “decided not to take any formal regulatory action on this occasion”, because of “the particular facts of this case and remedial measures taken post incident”, and closed the case. The ICO published that letter, with redactions, in its freedom of information disclosure log in July 2026. There was no fine and no reprimand.

The regulator not acting does not decide whether anyone affected is owed anything; that is a separate question for the courts. We found no published court claim about this incident. What the law says about compensation generally is on the data breach page.

Time limit. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Identity. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

Complaining. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the ICO, the UK's data protection regulator.