DIRECT ENERGY, LP

Direct Energy LP notified customers of a ransomware attack on a third-party data analytics vendor on November 3, 2020. Unauthorized parties accessed and extracted client files containing customer information, potentially including bank account numbers, credit card data, Social Security numbers, and credentials. The vendor did not pay the ransom. Direct Energy suspended activity with the vendor, notified law enforcement and card networks, and offered two years of identity monitoring.