South Staffs Water - Customers Criminal Cyber-Attack.

[Deleted User]

ukpobrien31 said:

I mean, where do I stand legally? Is there anything that can be done, or have they covered themselves from a GDPR point of view in terms of following the steps necessary, whatever they are?

What, legally, do you wish to pursue?  Or is this just a shout for compo?

MSE_ForumTeam5

We've merged three threads on this issue

FreedomBringsPeace

Ive not received a letter i happened to come across it online by chance! 

FreedomBringsPeace

Where do we stand if we fall victim to our banks being compromised, are we covered by our banks? 

M0ssim0_2

I've also had a letter today and I'm also concerned about how I'd stand, liability wise, if a criminal uses the data fraudulently to set up direct debits to an illegitimate source. They have offered a 12 month free subscription to a monitoring service but once the data is out there it's not going to suddenly disappear after 12 months, it's going to be floating around the Dark Web for evermore. They have also suggested we can fork out £25 to set up protective registration with CIFAS. I think, at the very least, they should offer to cover this. But then you have the ongoing hassle of jumping through extra hoops authorising transactions. Potentially, the only way to avoid being left open to ongoing fraud, in my opinion, is to swap banks. 

MattMattMattUK

FreedomBringsPeace said:

Where do we stand if we fall victim to our banks being compromised, are we covered by our banks? 

There is not enough information for someone to be able to "compromise" your bank account. They will have the account number, sort code, name and address, which means that they could pay some money into your account or in theory attempt to set up a Direct Debit. If a Direct Debit was set up then you would be covered. 

With the information that they have there is no way for them to get money out/transfer money from your account.

MattMattMattUK

M0ssim0_2 said:

I've also had a letter today and I'm also concerned about how I'd stand, liability wise, if a criminal uses the data fraudulently to set up direct debits to an illegitimate source. 

There are a lot of checks for a company to be allowed to use Direct Debits, an "illegitimate source" is not allowed to run a Direct Debit payment system. There is also the Direct Debit Guarantee which covers any unauthorised transactions. You can also see, and banks notify you before any money comes out if a Direct Debit is set up on your account.

M0ssim0_2 said:

They have offered a 12 month free subscription to a monitoring service but once the data is out there it's not going to suddenly disappear after 12 months, it's going to be floating around the Dark Web for evermore.  

Almost all fraud occurs with fresh data.

M0ssim0_2 said:

They have also suggested we can fork out £25 to set up protective registration with CIFAS. I think, at the very least, they should offer to cover this. 

They only tent to offer CIFAS protective registration if the data uses contains a lot more personal information than was in this leak, in a case like this it is not needed.

M0ssim0_2 said:

But then you have the ongoing hassle of jumping through extra hoops authorising transactions.

You do not have to jump through any extra hoops to authorise transactions with protective registration. The only time it has an impact is if you open a new product or service, such as a bank account, in which case they will double check to make sure you are really you.

M0ssim0_2 said:

Potentially, the only way to avoid being left open to ongoing fraud, in my opinion, is to swap banks. 

You can do that if you want, it will likely make no difference to the probability of fraud being committed against you.

Stompa

Blast, I just got one of these letters. Has anybody tried the trueidentityprotect service yet? Is it worthwhile?

Liamaiden

Yes, had one this afternoon (Cambridge Water). Have paid the £25 for CIFAS, angry that we have to pay it seeing as it's their mess up! No email address for the top man at South Staffs to request reimbursement (typical) but I've mentioned it big time on FB. Instagram next methinks... 

Stompa

Well registration with TrueIdentity was pretty straightforward, though did require me remembering which accounts I had opened some 20+ years ago.

Dark Web Monitoring is a bit of a mystery though, and instructions seem to be non-existent. For example you can enter a bank account, but it doesn't say what format should be used (presumably it would need both sort code and account number). Does anybody know?