Breach Disclosure: People's Energy

On December 16, 2020, a database containing the details of 270,000 customers of the energy company People's Energy was stolen, which included names, addresses, birthdates, phone numbers, tariff and energy meter IDs. People's Energy is an energy supplier based in Scotland, which was founded in 2017 with around 270,000 customers (all of whom were included in the data breach).

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

On December 16, 2020, People's Energy was breached due to an unauthorized third party gaining access to one of the systems used to store member data. Included in the compromised data was:

Names
Addresses
Phone Numbers
Data of Birth
Email Addresses
People's Energy Account Numbers
Tariff Details
Gas and Electricity Meter Identification Numbers

For a small number of members (0.1%), some partial financial data was disclosed. This data contained user information for both current and former members of People's Energy.

This breach was found on RaidForums being advertised by a user known as "pompompurin" who stated in the listing that they were responsible for the breach and have posted it for free on RaidForums.

Figure 1: Breach advertisement on RaidForums