MalwareEnergy & UtilitiesUtilitiesRansomwareStolen CredentialsData EncryptedData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Ransom DemandedFinancial accountCredentialsIdentity (basic)LowContained

DIRECT ENERGY, LP

bd_c3f1bce0188340fd · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 12, 2021

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for DIRECT ENERGY, LP →2 incidents on file

Direct Energy LP and affiliates experienced a ransomware attack on November 3, 2020, targeting a third-party data analytics vendor. Unauthorized parties accessed and extracted customer files, potentially exposing bank account, credit card, username, password, and SSN data. The vendor did not pay the ransom. Direct Energy suspended the vendor, engaged forensics, notified law enforcement, and offered 24 months of Experian IdentityWorks to affected customers.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 3, 2020

Begins

Jul 12, 2021

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_b05c585327449b3c2021-07-02 · +10dVerified

Name: DIRECT ENERGY, LP
norm: direct energy

Name: DIRECT ENERGY, LP
norm: direct energy
Industry: Energy & Utilitiesllm

Discovered: —
Breach occurred: Nov 3, 2020
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Financial accountCredentialsIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Third party: via Data analytics vendor
Initial access: supply_chain

During the incident: Engaged an outside vendor to help identify updated contact information
Vendor took actions to mitigate the incident, including notifying law enforcement
Vendor successfully locked out unauthorized users from their system
Vendor undertook a full forensic investigation of the incident
Suspended all activity with this vendor
Notified Visa, MasterCard, American Express and Discover that they may take appropriate action to protect card holders
Changes made: Offering a complimentary two-year membership of Experian’s IdentityWorks
Implemented a password change in our systems as precaution
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJul 2 · first

California State AG+10d · this page

Pattern: first filing Jul 2 (NH), last Jul 12 (CA) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-542762
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 12, 2021
Raw hash: a893caf5286451e67569349a63524bc66ec4791af017da34360d1840347d4203

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityDIRECT ENERGY, LP

Victim entityDIRECT ENERGY, LP

IncidentRansomware

Stated responseEngaged an outside vendor to help identify updated contact information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov