In the never-ending cycle of data breach news to hit us in 2020 has come in the form of environmental provider People’s Energy, continuing an attack on the energy industry with personal information on all former and current domestic customers accessed.
Theft Not So Friendly
In this latest cyberattack episode, thieves were able to access names, addresses, phone numbers and email addresses of consumers as well as birthdates, account numbers, tariffs and meter ID numbers.
Thankfully People’s Energy was able to relay to consumers that financial information and account passwords were not included in the breach and remain secure despite the attack, which comes as a huge relief.
On December 17th the company became aware of the attack and acted immediately to close the compromised route that was being used to access the internal system.
Shutting down this access point was accomplished within hours of the threat being detected, however they were victim to a number of personal records being accessed in that time frame. Upon discovery of the breach, People’s Energy were rapid in contacting Ofgem via it’s Information Commissioner’s office and begin the police investigation.
The next day customers were alerted to the breach and provided with advice towards suspicious contact.
In order to greatly reduce risk to customers through the breach, each customer was provided with measures towards responding to any communication with threat actors and the ability to verify the source. A dedicated contact line was set up along with an email helpline by the company specifically to aid in this area.
People’s Energy is extremely upset with the occurrence of the breach, especially as their company is a Community Interest Company that focuses their approach on putting customers and community upfront.
Although they are not the first in a string of attacks on the energy industry. May 2020 saw Elexon’s internal IT systems compromised resulting in many files published on the internet the following month, whilst wind energy giant EDP fell victim to Ragnar Locker ransomware resulting in the theft of over 10TB of sensitive company files.
From these attacks, the usual formula of attacking customers through the stolen data is in the arenas of fraud and phishing scams. Any customer of any company is now advised to contact the company directly should any supposed company employee begin to request information online.