Southern Water - Data breach

vonhelldorf91

lostmyname said:

I’ve been notified by Southern Water that they have been targeted by a cyber attack and my data (along with others) has been compromised.

I can understand they would have my name and address on record, as well as my bank details, but what puzzles me is that they also mentioned my NIN and DOB, if they were provided.

Now, I’ve had this account several years so can’t remember if I supplied those, but beside the point, why would they need this information at all?

What actions should I now take to protect myself from further possible ID fraud?

Other than giving me a free 1 year subscription with Experian, they have not given any other advice.

Thank you 

I hate how much they leave you in the dark when things like this happen. There isn't much info on the internet either. The best advice I've gotten so far is from a law firm that had written an article about it. You can only claim compensation if you're suffering a lot of stress because of it (understandable in the circs) or you've had money taken from your account or your credit rating damaged. 

The Experian checker is good but I'd speak to your bank too. Might be safest to open new accounts.

If anyone is interested this is the site where I got legal advice it was a site called Legal Expert 

vonhelldorf91

cressglas said:

I note that the attack happened on 22nd January and yet they didn't notify us until the 22nd February (approx) and I would welcome any informed advice on any precautions or indeed class action we should take, not content with not protecting our water they seem to be unable to protect our data. 

From what I understand they suspected a breach had happened in Jan and confirmed it in Feb which is when they wrote to everyone. There are some good data breach firms doing compensation claims. There are criteria to meet but it's worth getting advice I say, especially if you're pretty worried. If you search for "Southern Water data breach compensation" some of the top sites that pop up are really informative. I've made a claim with Legal Expert if that helps

vonhelldorf91

lostmyname said:

Smileyman said:

I am a victim here too. Has anyone any news about a possible class action for compensation against Southern Water? If so please post details so others may participate! 

Jilldu said:

I have had the same notification, do I have to Notify my Bank about this ? Has any on had the Experian experience  ?Thanks in advance .

I'm sorry I have no advice to offer, I hope someone can jump into the thread and help us out!

Legal Expert is running a class action service I believe. I got advice from them earlier. They're representing a lot of people in response to the South Staffs Water data breach too they said so they have good experience of this kind of thing.

I would notify your bank. They may have good advice to give. The Experian service is good too. It tracks things in real time

vonhelldorf91

Smileyman said:

I am a victim here too. Has anyone any news about a possible class action for compensation against Southern Water? If so please post details so others may participate! 

Check out Legal Expert. I made a claim with them before

vonhelldorf91

solly26 said:

I have had the same notification of a cyber attack by Southern Water. Are there any downsides to accepting their offer of a free 1 year subscription with Experian? Will it have any effect on renewing my mortgage? Will I be pressured into renewing this service after the free year? I make it a rule not to accept free trials of anything as it can be complicated to cancel these services. Is it not possible that Southern Water is just drumming up business for Experian. I hate to be so cynical but modern life has made me very distrustful of anything “free”.

From what I was told by a data breach solicitor at Legal Expert they said that accepting the Experian offer is fun and doesn't count as compensation. It's best to speak to someone though about your mortgage. Legal Expert offer free advice on their live chat which I found really useful

MattMattMattUK

vonhelldorf91 said:

lostmyname said:

Smileyman said:

I am a victim here too. Has anyone any news about a possible class action for compensation against Southern Water? If so please post details so others may participate! 

Jilldu said:

I have had the same notification, do I have to Notify my Bank about this ? Has any on had the Experian experience  ?Thanks in advance .

I'm sorry I have no advice to offer, I hope someone can jump into the thread and help us out!

Legal Expert is running a class action service I believe.

Once again, there is no such thing as a class action in the UK.

vonhelldorf91 said:
I got advice from them earlier. They're representing a lot of people in response to the South Staffs Water data breach too they said so they have good experience of this kind of thing.

You got a marketing pitch from them earlier.

vonhelldorf91 said:

I hate how much they leave you in the dark when things like this happen. There isn't much info on the internet either. 

They have said that there has been a data breach and what data was obtained, there is not really much more that they can tell you. There is plenty of information on the internet about data breaches, much of it is scaremongering. 

vonhelldorf91 said:
You can only claim compensation if you're suffering a lot of stress because of it (understandable in the circs) 

Stress is difficult to impossible to claim for in a situation like this, there should not be any stress, this is a minor or even non-issue. 

vonhelldorf91 said:
or you've had money taken from your account or your credit rating damaged. 

If someone has suffered direct, attributable financial loss then they are entitled to compensation. Your credit rating is a meaningless number made up for marketing purposes and as such cannot be damaged.

paulie_78

I've had the letter and am now some way down the road in communications with Southern Water. They told me that NI numbers will only have been held by them (and therefore stolen) in the event that payments to them were made via benefits services, but not otherwise.
I used their code to join Experian+. I then submitted a successful credit application which went through without any warnings appearing through Experian or anywhere else. I used that as an argument that SW should at least provide membership of the other two big credit reference agencies as clearly Experian wasn't enough.  Southern Water considered, 'escalated' and then rejected this request all within 24 hours.
I am awaiting the outcome of a request to Experian to provide CIFAS registration (which is the way SW are handling that option) which the documentation says is possible for those at greater risk. Experian has been silent for a week.

MattMattMattUK

paulie_78 said:

I've had the letter and am now some way down the road in communications with Southern Water. They told me that NI numbers will only have been held by them (and therefore stolen) in the event that payments to them were made via benefits services, but not otherwise.
I used their code to join Experian+. I then submitted a successful credit application which went through without any warnings appearing through Experian or anywhere else. I used that as an argument that SW should at least provide membership of the other two big credit reference agencies as clearly Experian wasn't enough.  Southern Water considered, 'escalated' and then rejected this request all within 24 hours.
I am awaiting the outcome of a request to Experian to provide CIFAS registration (which is the way SW are handling that option) which the documentation says is possible for those at greater risk. Experian has been silent for a week.

Why do you believe you are at greater risk?

paulie_78

MattMattMattUK said:

paulie_78 said:

I've had the letter and am now some way down the road in communications with Southern Water. They told me that NI numbers will only have been held by them (and therefore stolen) in the event that payments to them were made via benefits services, but not otherwise.
I used their code to join Experian+. I then submitted a successful credit application which went through without any warnings appearing through Experian or anywhere else. I used that as an argument that SW should at least provide membership of the other two big credit reference agencies as clearly Experian wasn't enough.  Southern Water considered, 'escalated' and then rejected this request all within 24 hours.
I am awaiting the outcome of a request to Experian to provide CIFAS registration (which is the way SW are handling that option) which the documentation says is possible for those at greater risk. Experian has been silent for a week.

Why do you believe you are at greater risk?

I believe I am at greater risk having only Experian+ in place compared to having the three (major) CRA subscriptions and CIFAS: having all those in place must surely improve the chance of early detection of a fraudulent event? What do you actually suggest we all do MattMattMattUK ?

MattMattMattUK

paulie_78 said:

MattMattMattUK said:

paulie_78 said:

I've had the letter and am now some way down the road in communications with Southern Water. They told me that NI numbers will only have been held by them (and therefore stolen) in the event that payments to them were made via benefits services, but not otherwise.
I used their code to join Experian+. I then submitted a successful credit application which went through without any warnings appearing through Experian or anywhere else. I used that as an argument that SW should at least provide membership of the other two big credit reference agencies as clearly Experian wasn't enough.  Southern Water considered, 'escalated' and then rejected this request all within 24 hours.
I am awaiting the outcome of a request to Experian to provide CIFAS registration (which is the way SW are handling that option) which the documentation says is possible for those at greater risk. Experian has been silent for a week.

Why do you believe you are at greater risk?

I believe I am at greater risk having only Experian+ in place compared to having the three (major) CRA subscriptions and CIFAS: having all those in place must surely improve the chance of early detection of a fraudulent event? 

That is not what they mean by at greater risk, it means those in the public eye, those who had more data breached (likely employees) etc. and not that you think the risk is higher than doing lots of different things. The CIFAS protective registration is the only one that would make the slightest difference to a false application being successful, the CRA subscriptions will not make a difference to it happening, though it might mean you know it has happened slightly quicker. The ICO will have signed off on the offering of Experian and the whole process, they are unlikely to modify it.

paulie_78 said:
What do you actually suggest we all do MattMattMattUK ?

Stop worrying and carry on with life. The risk is minimal in the first place, this data breach based on the data in it makes so little difference that the increase in risk would be regarded as statistically irrelevant.