SUNRUN INC.

On January 20, 2017, Sunrun Inc. experienced a targeted phishing scam where a scammer impersonated the CEO to request employee W-2s from the payroll department. The phishing email was not recognized as a scam, resulting in the external disclosure of 2016 W-2s for current and former employees. Affected data included names, addresses, Social Security numbers, salaries, and taxes withheld. Sunrun notified the FBI, IRS, and state taxing authorities and offered two years of free credit monitoring via Experian's ProtectMyID Alert. The company is reinforcing its information security training to prevent future incidents.