WARNING: this content includes themes relating to family violence.
The Australian Energy Regulator (AER) has taken Sumo Power Pty Ltd and Sumo Gas Pty Ltd (collectively, Sumo) to the Federal Court for allegedly breaching the National Energy Retail Rules (the Rules) by allowing the personal information of 21 customers who may have been affected by family violence to become accessible to unauthorised users online.
The personal information of these customers was accessible between 23 February 2024 and 13 May 2024, as part of a broader data leak of Sumo’s customer base. The affected customers were identified and contacted following the incident. Customers with questions about the incident can contact Sumo directly.
Details included customers’ names, dates of birth, driver licence numbers, concession numbers, credit scores, credit check results, email addresses, mobile numbers, National Metering Identifiers, residential addresses, usage meter data, welcome agreements, invoices and account notes. The AER understands Sumo has since fixed the security issues that caused the data leak.
AER Chair Ms Clare Savage said that, since the Rules were amended in 2023, retailers have had obligations to support customers affected by family violence, including protecting customer information and prioritising customer safety.
“This is the first time the AER has acted to enforce protections for customers affected by family violence. It sends a clear message to energy retailers that they must have effective safeguards in place to protect customer information and prioritise customer safety.
“Unauthorised access to personal information can have serious consequences for customers affected by family violence. These protections are essential to safeguarding their privacy and safety.
“The AER takes these obligations extremely seriously and will act where they are not met,” Ms Savage said.
Notes
Court proceedings
As the matter is now before the Court, the AER will not be making any further comment, and no further documents will be made available.
National Energy Retail Rules
The AER alleges that, between 23 February 2024 and 13 May 2024, Sumo failed to comply with rule 76G(1) of the National Energy Retail Rules by disclosing or providing unauthorised persons with access to customer information of 21 customers who may be affected by family violence, without the consent of those customers.
In May 2023, the National Energy Retail Rules were amended to include new obligations on retailers related to family violence, including requirements to have a family violence policy, to protect the information of customers affected by family violence, and to prioritise the safety of these customers in any dealings with them.
To help retailers understand and comply with their family violence obligations, the AER issued guidance and wrote an open letter to the energy sector calling on the industry to make its services safer for customers affected by family violence.
In February 2026, the AER also brought together retailers for an open forum to share learnings on how they support consumers affected by family violence.
Sumo customer support
Sumo customers with concerns about their personal information should first contact Sumo directly and, if the issue is not resolved, raise it with their local energy ombudsman.
Family violence support and resources
The AER has published a fact sheet explaining the supports available to customers affected by family violence.
1800RESPECT
Offers free, 24 hours a day, 7 days a week counselling support to people impacted by domestic, family or sexual violence. Contact by calling 1800 737 732 or visiting 1800respect.org.au.
Are You Safe at Home?
The Are You Safe at Home? website provides access to family violence support resources and a list of both national and location-based resources.