The Australian Energy Regulator (AER) has taken Sumo Energy to the Federal Court for allegedly breaching the National Energy Retail Rules (the Rules) by allowing the personal information of 21 customers who may have been affected by family violence to become accessible to unauthorised users online.
The personal information of these customers was accessible between 23 February 2024 and 13 May 2024, as part of a broader data leak of Sumo Energy’s customer base. The affected customers were identified and contacted following the incident.
Related article: Sumo fined for cutting off ‘wall of shame’ customers
Details included customers’ names, dates of birth, driver’s licence numbers, concession numbers, credit scores, credit check results, email addresses, mobile numbers, National Metering Identifiers, residential addresses, usage meter data, welcome agreements, invoices, and account notes.
The AER understands Sumo Energy has since fixed the security issues that caused the data leak.
AER chair Clare Savage said that, since the Rules were amended in 2023, retailers have had obligations to support customers affected by family violence, including protecting customer information, and prioritising customer safety.
“This is the first time the AER has acted to enforce protections for customers affected by family violence. It sends a clear message to energy retailers that they must have effective safeguards in place to protect customer information and prioritise customer safety.
“Unauthorised access to personal information can have serious consequences for customers affected by family violence. These protections are essential to safeguarding their privacy and safety.
Related article: Sumo Power takes $1.2m hit for misleading plans
“The AER takes these obligations extremely seriously and will act where they are not met,” Savage said.
