Southern Water Disclosed £4.5 Million of Costs From the Black Basta Attack

In February 2025 Southern Water, the English water and wastewater utility, disclosed £4.5m in costs arising from the cyberattack it suffered in early 2024. Within the same fortnight the leaked Black Basta archive was published, and reporting drawn from it described the attacker’s side of the same incident.

This corpus contains no other case where a victim’s audited accounting and the attacker’s private record of the same event are both in the public domain.

The company’s figure is £4.5m of incurred expenses. Reporting on the leaked chats describes a demand in the region of $3.5m and an offer from the victim side reported at around $750,000, with no public confirmation that any payment was made.

Southern Water has not commented on the negotiation figures. This desk treats the demand and the offer as reported readings of chat messages, not as established facts about the company’s conduct.

The £4.5m is response cost: investigators, lawyers, monitoring, remediation. The $3.5m is an extortion demand. Adding them, or treating one as a discount on the other, would be a category error — and it is the error that the phrase “the attack cost £4.5m” invites.

This corpus made the same distinction at 25-0708, where insurance claims were found to quantify availability harm that public reporting does not, and at 25-1219, where no mechanism connects a breach to a subsequent fraud. Cost, demand and harm are three ledgers and they rarely reconcile.

A privately held utility with no reporting obligation would have published nothing. The £4.5m is in the public record because Southern Water publishes accounts, and the accounts required it to say where the money went.

That is the corpus’s securities-listing filter, recorded at 25-0924b, working on a company that is not listed but is regulated. It is the same mechanism: an obligation to account produces a number, and the absence of that obligation produces silence rather than a smaller number.

Approximately a tenth of Southern Water’s customers had data affected, per the company’s 2024 statements, and the company said operations, financial systems and customer-facing platforms were not impacted.

A water utility losing customer records is a data incident. The water sector’s exposure that this desk cannot measure is the other one — control systems — and no 2025 case in this corpus documents it. That absence is filed separately at 25-0228.