State-owned energy provider Synergy has launched an investigation into claims of a massive data breach allegedly involving over 900,000 sensitive document, including the personal records of customers.
State-owned energy provider Synergy has launched an investigation into claims of a massive data breach allegedly involving over 900,000 sensitive document, including the personal records of customers.
The alarm was raised by threat intelligence platform VECERT, which says a threat actor known as 'hackboy' successfully exfiltrated a database containing sensitive customer information.
According to claims made by the third-party group, the compromised data includes full names and dates of birth; phone numbers and email addresses; physical residential addresses; account IDs and payment balances; and detialed billing statements.
- Geraldton airline WA's latest ransomware victim
- Perth family law firm Paterson & Dowding wins injunction to protect stolen data
- Summit brings quantum warning for WA businesses
A spokesperson for Synergy said in a statement the utility was taking the claims seriously, but that no evidence had yet been uncovered to indicate the claims were legitimate.
"Synergy is investigating a claim by an external party regarding a potential cyber security incident. Based on information available at this time, there is no evidence of data loss or compromise," the spokesperson said.
The provider confirmed it was working with the Office of the Digital Govenrment and independent cyberseucrity experts to verify the threat.
It can take days for forensic audits of large-scale databases.
Preliminary analysis of screenshots provided by the threat actor, meant to provide a sample and verificaiton of stolen data, included the presence of Victorian addresses—unusual for a utility that exclusively serves Western Australian households—and the use of the name 'Synergy Electricity Corporation,' a title which does not officially exist.
This incident comes at a difficult time for the energy giant. Only months ago, the Economic Regulation Authority took enforcement action against Synergy for failing to refund over $40 million in overcharges to customers on closed accounts.
The utility was given until April 30, 2026, to rectify those payments or face significant fines.
