Wrong kind of spark: Innova Energie ex-employee steals customer IBANs in insider breach

Dutch energy company Innova Energie has sent an email to affected customers to inform them of a recent data breach carried out by a former employee.

“We have determined that an employee of Gewoon Energie [a subsidiary of Innova Energie, ed.] unlawfully obtained your customer data. Gewoon Energie’s services have not been affected. The supply of gas and/or electricity remains guaranteed,” the email says.

According to the company, the worker managed to steal personal details of an undisclosed number of clients, including full names, gender, dates of birth, home addresses, phone numbers, email addresses, correspondence history, and international banking account numbers (IBANs).

Innova Energie states that it immediately took measures to strengthen its security. For starters, the employee who illegally obtained the customer data was fired on the spot.

In addition, the energy supplier reported the incident to the privacy and data protection authority. Lastly, it filed a report with the Public Prosecution Service.

“Not every data breach leads to actual abuse, but we cannot rule out the possibility of misuse of your data. We believe it is important to be transparent and to inform you about this incident so that you can be alert to any unusual activities,” the email continues.

Innova Energie urges affected customers to remain vigilant for any suspicious emails, text messages, phone calls, or letters that appear to be sent by the energy company. Victims shouldn’t click on any URLs if they’re hesitant about who the actual sender is.

Furthermore, affected customers are advised to never share login credentials, PINs, or details about their banking accounts by email or phone. Lastly, they’re encouraged to check their bank statements for any unknown financial transactions.

“We regret that this incident occurred and understand that it may cause you inconvenience. We are taking all necessary actions to prevent such an incident in the future,” the email concludes.

Gewoon Energie was founded in 2021 as a subsidiary of Innova Energie, an energy supplier active on the Dutch market since 2010.

As Dutch news outlet Tweakers.net points out, in September 2025, Innova lost a preliminary injunction case regarding misleading customer outreach. In that case, the company claimed that its customer database had been obtained by a third party through illegal means. However, Innova’s claims were dismissed by the court.

It is unclear whether this case is related to the data breach that has now been disclosed.

Unlock more exclusive Cybernews content on YouTube.