Inside the Tibber Breach: How a Norwegian Energy Provider Lost 50,000 Customer Records

In November 2024, Tibber -- the Norwegian renewable electricity provider known for its dynamic pricing model and smart energy platform -- suffered a database breach that exposed personal data belonging to its customers. The breach, catalogued with a pwned count of 50,002 records, affected individuals who had registered accounts with Tibber's service. The exposed information included names, email addresses, and usernames -- the kind of personally identifiable data that enables targeted phishing attacks, identity fraud, and account compromise across other platforms.

Why This Is Dangerous

Energy sector companies like Tibber occupy a uniquely sensitive position: they hold customer identity data alongside information about home energy consumption, smart device connectivity, and payment details. Even when a breach does not expose passwords directly, the combination of real names, email addresses, and usernames provides attackers with enough information to craft highly convincing phishing emails, bypass knowledge-based authentication questions, and enumerate accounts across other services.

What Was Exposed

• Email addresses -- primary contact and login identifier for most online services
• Usernames -- enabling account enumeration and targeted social engineering
• First names and last names -- completing personal identity profiles usable for fraud
• 50,002 total affected records

Why This Matters

A breach affecting a utility or energy provider carries implications beyond the immediate data exposed. Tibber customers are often early adopters who connect smart home devices and electric vehicle chargers to the platform -- making their accounts of elevated interest to threat actors seeking network access or energy consumption intelligence. Core downstream risks include:

• Credential stuffing -- attackers testing leaked email addresses with commonly reused passwords across other services
• Account takeover -- social engineering customer support teams using real names and usernames to reset accounts
• Identity theft -- full-name and email combinations used to register fraudulent accounts or apply for credit
• Phishing -- highly personalized emails crafted using names and service context to deceive victims into revealing passwords or payment details

How Database Breaches at Utility Companies Work

Database breaches at utility and energy platforms typically occur through one of several vectors: exploitation of unpatched vulnerabilities in customer-facing web applications, compromised administrative credentials, misconfigured cloud storage exposing customer data publicly, or third-party supplier compromise. Unlike stealer log incidents where malware captures credentials from individual devices, database breaches extract data directly from a company's backend systems -- meaning customers have no individual defense against the exposure; the vulnerability lies entirely within the organization's infrastructure. Tibber's breach falls into this category, with the customer record database itself being the point of exfiltration.

Check If You Are Affected

Heroic's breach search engine indexes over 400 billion exposed records -- including the Tibber breach dataset. If you have ever registered an account with Tibber or used a similar email address across multiple services, search now to see whether your data was part of this or any other known breach.

Search the Heroic Breach Database -- Free