WARNING: this content includes themes relating to family violence.
On 14 September 2026, the AER instituted proceedings in the Federal Court alleging that Sumo Power Pty Ltd and Sumo Gas Pty Ltd (collectively, Sumo) breached the National Energy Retail Rules.
The AER alleges that, between 23 February 2024 and 13 May 2024, Sumo failed to comply with rule 76G(1) of the National Energy Retail Rules by disclosing or providing unauthorised persons with access to customer information of 21 customers who may be affected by family violence, without the consent of those customers.
The AER is seeking civil pecuniary penalties, declarations and costs.
Background
The personal information of the 21 affected customers was made publicly accessible between 23 February 2024 and 13 May 2024, as part of a broader data leak of Sumo’s customer base. The affected customers were identified and contacted following the incident.
Leaked details included customers’ names, dates of birth, driver licence numbers, concession numbers, credit scores, credit check results, email addresses, mobile numbers, National Metering Identifiers, residential addresses, usage meter data, welcome agreements, invoices and account notes.