MalwareEnergy & UtilitiesUtilitiesRansomwareSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedFinancial accountCredentialsMediumContained

DIRECT ENERGY, LP

bd_195ec47bf66a8246 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 3, 2020

Filed

Dec 2, 2020

To disclose

29 days

Affected

1,160state residents only

Linked

7 filings

Confidence

64%

Full breach record for DIRECT ENERGY, LP →2 incidents on file

Direct Energy LP reported a ransomware attack on its data analytics vendor, Kitewheel, LLC, on November 3, 2020. Unauthorized individuals accessed and extracted client files containing personal information of Direct Energy customers, including usernames, passwords, and payment card/bank account information. Approximately 1,160 New Hampshire residents were affected. Direct Energy suspended activity with the vendor, reset passwords, notified payment processors, and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 29 days

Nov 3, 2020

Begins

Nov 3, 2020

Discovered

Dec 2, 2020

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Montana State AGbd_15fca67992f8604f2020-12-02Verified
Illinois State AGbd_18247c0c8da5a2462021-01-01 · +30dVerified
Maine State AGbd_8962841e2e4a1fd12021-01-06 · +35dVerified
Maine State AGbd_f994b9ede3225a022021-01-08 · +37dVerified

Show 2 more filings ↓up to 336d gap

California State AGbd_bd7e340089a059a62021-01-21 · +50dVerified
Illinois State AGbd_d00d7ca04529ab442020-01-01 · +336dCandidate

Name: Direct Energy LP
norm: direct energy

Name: DIRECT ENERGY, LP
norm: direct energy
Industry: Energy & Utilitiesllm

Discovered: Nov 3, 2020
Breach occurred: Nov 3, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 2, 2020
Affected individuals: 1,160state-resident count only
Data types: Financial accountCredentials
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the Attorney General of New Hampshire
Third party: via Kitewheel, LLC
Initial access: supply_chain

During the incident: Kitewheel contained the incident and immediately commenced an investigation
Kitewheel retained a forensic expert
Kitewheel notified the FBI of the incident
Direct Energy is conducting its own investigation into the scope and extent of the compromised data
Direct Energy instituted a mandatory password reset across all impacted customers
Direct Energy has temporarily suspended all commercial activity with Kitewheel
Direct Energy notified Visa, Mastercard, American Express and Discover and certain payment processor entities
Direct Energy is offering each impacted customer a complimentary two-year membership in Experian's IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+336d

New Hampshire State AG+336d · this page

Illinois State AG+366d

Maine State AG+371d

Maine State AG+373d

California State AG+386d

Pattern: first filing Jan 1 (IL), last Jan 21 (CA) — a 386-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/direct-energy-20201202.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 2, 2020
Raw hash: 714c63fb23b6a86850017d01103436440e57e477710bde233b47871fe3868b4e

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityDirect Energy LP

Victim entityDIRECT ENERGY, LP

Incidentdiscovered Nov 3, 2020

Stated responseKitewheel contained the incident and immediately commenced an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov