Cl0p Masqueraded as South Staffs Water Employee for Two Years — ICO Fines UK Water Utility £963,900

A UK Cybercrime Journal analysis of the ICO investigation establishes that Cl0p entered South Staffordshire Water in September 2020 through a phishing email that deployed the Get2Loader loader and SDBBOT backdoor, then masqueraded as a South Staffs Water employee inside the network for nearly two years. Discovery came in July 2022 only because staff chased IT performance slowdowns, not because any control fired. By August 2022 Cl0p had published 4.1 TB of stolen data on its Tor leak site, exposing personal information of 633,887 customers and employees, and the ICO announced its £963,900 fine on May 11, 2026. The regulator's findings name the failures precisely: two domain controllers unpatched against ZeroLogon (CVE-2020-1472), Windows Server 2003 hosts running past end of extended support, zero internal or external vulnerability scans across an 18-month window, and an outsourced SOC blind to 95% of the network.

The mechanism is the argument. Entry cost one phish and no zero-day: Microsoft patched ZeroLogon in August 2020, a month before the phish landed, and leaving two domain controllers unpatched meant Cl0p needed no further exploit to take the entire domain whenever it chose, so the breach stayed bounded by the attacker's objective rather than by the victim's controls. The per-record arithmetic reframes the fine: £963,900 across 633,887 people is roughly £1.52 each, trivial next to two years of response costs, leak-site publication, and the scam-email wave customers now report, so absorbing the penalty is a viable board calculation unless enforcement starts to scale. This story earns attention over the other thirty today because it converts a penalty notice into a named checklist of critical infrastructure failure: 95% SOC blindness, an 18-month scan gap, and 2003-era servers on a 2020s network.

The defender actions are concrete. Patch every domain controller against CVE-2020-1472; Windows Server 2003 cannot take that update, so any 2003-era host holding a domain role has to be retired, not mitigated. Commission an independent audit of the outsourced SOC that reconciles monitored log sources against the full asset estate, using the ICO's 95% blindness figure as the benchmark to beat, and restart scheduled internal and external vulnerability scanning on a documented cadence, the control the regulator found absent for 18 months. Hunt the specific chain: phishing-delivered Get2Loader and SDBBOT execution on endpoints, outbound transfer volume consistent with 4.1 TB leaving over a multi-year window, and the unexplained host slowdowns that actually surfaced this breach. Monitor Cl0p's Tor leak site for your organization's name instead of waiting for the email.

Two developments would change this assessment. A fresh fraud or extortion campaign built on the 633,887-record dataset beyond the scam emails already reported would confirm the exfiltrated personal data is being actively worked rather than warehoused. Follow-on ICO action against other UK utilities or CNI operators running outsourced SOC models would mark this £963,900 fine as a regulatory template rather than a one-off.