Duke Energy exposed thousands of Social Security numbers, class action lawsuit says
A Duke Energy data leak exposed thousands of customers’ personal information, including Social Security numbers, addresses, phone numbers and birthdays, according to a class action lawsuit filed by one data breach victim.
Matthew Saunders, of St. Petersburg, Florida, filed the lawsuit in December in Charlotte’s U.S. District Court for the Western District of North Carolina. He alleged he is one of thousands of customers affected by the May cybersecurity breach.
Charlotte-based Duke Energy is North Carolina’s monopoly electricity utility. It also provides electric and natural gas utilities to customers in South Carolina, Tennessee, Florida, Indiana, Ohio and Kentucky.
In May, it released a statement on its website alerting customers that “a third party may have obtained certain customer information from our public website.”
Saunders, according to the Dec. 12 complaint, has always been “very careful about sharing his sensitive (personal identification information).”
Then he got a letter from Duke Energy saying his “PII was improperly accessed and obtained by unauthorized third parties, including his name, account number, address, email address, phone number, date of birth, tax ID number, and Social Security number,” the complaint says.
Thousands, according to court documents, got the same letter.
Thousands, Saunders argues, are now vulnerable to identify theft.
The number of people affected are “so numerous that joinder of all members is impracticable, if not completely impossible,” according to the complaint.
Saunders demands Duke Energy review and potentially revise its protection policies and asks that it “delete, destroy, and purge vulnerable customers’ personal identifying information “unless (it) can provide to the Court reasonable justification for the retention and use of such information when weighed against the privacy interests of customers.”
The lawsuit also demands Duke Energy stops keeping PII on a cloud-based database and asks the court to award a not-yet determined amount of money to affected customers for actual, nominal, consequential, and punitive damages.
The breach, Duke Energy said in a statement to The Charlotte Observer, did not affect all customers, and the company took “prompt actions to help further protect customer accounts.”
Duke Energy is “communicating directly with potentially affected customers by email and USPS,” Valerie Patterson, a Duke Energy spokesperson, wrote in an email. Those customers can get free credit monitoring and identity theft protection services through Duke Energy.
Saunders’ claims trail the town of Carborro’s earlier December lawsuit alleging Duke Energy for decades engaged in deception about climate science, which stalled the transition to renewable energy and resulted in “largely unabated” greenhouse gas emissions. The town, which sits 30 miles west of Raleigh, alleged Duke Energy executives knew greenhouse gases were harmful as early as 1968 and continued to promote their use.
This story was originally published January 10, 2025 at 5:00 AM with the headline "Duke Energy exposed thousands of Social Security numbers, class action lawsuit says."
