People's Energy peoplesenergy.co.uk People's Energy data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In December 2020, UK energy supplier People's Energy had customer data stolen, which Have I Been Pwned lists as 358,822 accounts. Names, email addresses, phone numbers, physical addresses and dates of birth were exposed. Customer passwords were not.
View all 13,118 breaches- Breach date
- 16 Dec 2020
- Affected
- 358,822
- Data exposed
- Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
People's Energy, a UK energy supplier, said an unauthorised third party got into a system holding customer data on 16 December 2020. The company said it told the Information Commissioner's Office and Ofgem straight away, and that police were investigating. It set up a helpline and an email address for customers and asked them to watch for suspicious contact.
Have I Been Pwned (HIBP) lists the breach with 358,822 accounts. It describes almost 7GB of files containing about 359k unique email addresses. Press reports at the time quoted lower customer numbers, so the HIBP figure is the one this page uses.
Sources checked: haveibeenpwned.com, solarpowerportal.co.uk, research-live.com
Last verified against the official page:
What was exposed
The data included names, email addresses, phone numbers, physical addresses and dates of birth. HIBP says the files also held People's Energy staff email addresses and bcrypt password hashes, but no customer passwords. People's Energy said no financial information for domestic customers was accessed.
What it lets criminals do
A name, home address and date of birth, all together, is the raw material for identity fraud: someone can pass basic checks when they call a bank or a mobile network pretending to be you. The phone numbers and email addresses are more likely to be used for phishing. A message that quotes your real address and says it comes from your energy supplier is much easier to believe, especially one about a bill, a refund or a price change.
What to do
The steps below match the data that leaked. Nothing here needs a password change for your People's Energy account, since HIBP says customer passwords weren't in the files, but changing it costs nothing if you reused it elsewhere.
What to do if you were in it
- 1
Expect phishing that mentions the breach
With your name, address and phone number out, scammers can write emails and texts that look personal. Don't click links in unexpected messages. Go to the company's site yourself.
- 2
Treat calls and texts about your energy account as suspect
If someone rings about a bill, refund or switching supplier, hang up and call the number on your latest bill. Real suppliers don't ask for full passwords or bank logins.
- 3
Tell your bank and mobile provider to add a security word
Because your name, address and date of birth leaked together, ask them to add extra verification on your account to make SIM swap and impersonation calls harder.
- 4
Watch your credit file
Check your report with a UK credit reference agency for accounts or applications you don't recognise. Consider a free fraud warning through Cifas Protective Registration if you're worried.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email and phone number, and Serus keeps monitoring and alerts you when your details turn up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the People's Energy data breach?
If you were a customer in December 2020, assume yes. You can also look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Names, email addresses, phone numbers, physical addresses and dates of birth. HIBP says customer passwords were not part of the data.
Should I change my password?
It's not required for this breach, because customer passwords weren't exposed. If you reuse passwords, change them anyway and turn on two-factor login.
Is there a settlement?
None is listed in the sources used for this page.
Sources
- Have I Been Pwned: PeoplesEnergy
- Have I Been Pwned: People's Energy Data Breach · haveibeenpwned.com
- solarpowerportal.co.uk/solar-technology/people-s-energy-suffers-data-breach-in-extremely-upsetting-cyberattack
- research-live.com/article/news/peoples-energy-company-suffers-customer-data-breach/id/5078072
Something wrong or out of date? Tell us and we'll re-check it.
