People's Energy

People's Energy functions as a retail energy supplier operating within the United Kingdom. The company supplies both electricity and gas to households across the country. In addition to residential users, it provides energy services to a limited portfolio of small business clients. Its product offering consists of standard and variable tariffs designed for domestic and commercial consumption. Customers receive billing and account management through the company's customer service platforms. The organisation is publicly recognised by the alias People's Energy. It competes in the UK's deregulated energy market alongside other licensed suppliers.

Prior to the December 2020 security incident, People's Energy maintained records for approximately 270,000 current and former customers. Among those records, fifteen small business clients had associated bank account information stored in the company's systems. The firm's headquarters is situated in the United Kingdom, though the specific city is not disclosed in the available sources. The size of its customer base positioned it as a mid‑scale participant in the UK retail energy sector. The breach description indicates that the entire customer database was compromised, reflecting the breadth of data held. No public figures regarding annual revenue, employee count, or infrastructure capacity are provided in the source material. Consequently, any assessment of the organisation's overall scale must rely solely on the customer count and business client figures cited.

On 16 December 2020, attackers gained access to People's Energy's customer database, exposing names, addresses, dates of birth, phone numbers, tariff details, and energy meter IDs for all 270,000 customers. The same intrusion allowed the exfiltration of bank account information belonging to the fifteen small business clients. Upon discovery, the company promptly notified all affected individuals about the compromise of their personal data. People's Energy reported the incident to the Information Commissioner's Office and the National Cyber Security Centre as required by UK regulations. It also engaged external cybersecurity experts to conduct a forensic investigation and to advise on remediation steps. Despite the breach, the organisation confirmed that no operational infrastructure was disrupted and that most customers did not suffer direct financial loss. Cybersecurity commentators characterised the event as severe due to the volume of data exposed, while acknowledging that the company's transparent disclosure and cooperation with regulators mitigated reputational harm.