Innogy

Innogy SE, headquartered in Germany, functioned as an energy company delivering electricity and gas services to customers. Its operations extended to the United Kingdom through the subsidiary npower, serving residential and commercial clients. The company's core activities involved the supply of energy, supported by distribution infrastructure and customer service operations. Innogy's corporate structure included multiple subsidiaries to manage regional markets, with npower representing its primary UK entity. The organization operated within a heavily regulated energy sector, adhering to national and European standards.

The most publicly documented event during this period was the February 2021 security incident at npower. A credential stuffing attack breached customer accounts, exposing personal information such as dates of birth, addresses, contact details, and partial banking data. This compromise led npower to shut down its mobile application and notify affected individuals. The company advised customers to change passwords and reported the breach to UK authorities. Cybersecurity analysts criticized the incident, noting the absence of strong protections like two-factor authentication. The breach emphasized the vulnerability of consumer data in the energy industry and the operational consequences of security lapses.