The account numbers, names and email addresses of around 1,600 British Gas customers may have been accessed by a third party. All potentially affected customers have been contacted by letter, and will each receive a £20 cheque “as a goodwill gesture”.
But British Gas added its own systems were not breached, instead an unnamed third party got the login details from another website the affected customers use.
It said there has been no suspicious activity on the accounts, and customers have only been alerted as a “precautionary measure”. Passwords have also been reset.
A British Gas spokesperson, said: “It is unfortunately a fact of modern life that login details can be stolen from various sources and then shared via third-party websites, so every company and every individual with an online presence should prioritise online security.
“British Gas systems were not breached, but 1,600 of our customers had their britishgas.co.uk login details accessed by a third party, who got these details from another website the affected customers use.”
It added payment information could not be accessed, as it is stored and encrypted separately.
A spokesperson from the Information Commissioner’s Office said: “Organisations have a legal duty to keep people’s personal data safe and secure. We have been made aware of an incident involving British Gas and are looking into the details.”