Skip to main content
Rank 3
miaowlicious
Rank 3
Nov 3, 2026 12:39 PM UTC
Solved

Ovo data breach - notified them a week ago and no response

I notified ovo of a bereavement. They responded with a completed direct debit mandate from another customer, including their bank account details.

I emailed them a week ago of this data breach and no response or anything. The customer needs to be notified as a matter of urgency. 

Should I email another dept or is this now just in the 8 week response cycle?

Thanks!

Abby_OVO
Abby_OVOBest Answer
Community Manager
Nov 4, 2026 9:00 AM UTC

Hey ​@miaowlicious 

 

Sorry to hear this.

 

If you could please send all of the details on this to media@ovo.com so they can support with this.

 

Do let us know if you have any further issues.

Currently Playing: She's Electric
View in thread

8 replies

Abby_OVO
Community Manager
Abby_OVOBest Answer
Community Manager
Nov 4, 2026 9:00 AM UTC

Hey ​@miaowlicious 

 

Sorry to hear this.

 

If you could please send all of the details on this to media@ovo.com so they can support with this.

 

Do let us know if you have any further issues.

Currently Playing: She's Electric
Rank 3
miaowliciousAuthor
Rank 3
Nov 4, 2026 8:32 PM UTC

Hi-thanks for your reply. 

I have been notified today that it has gone to a customer resolution specialist-do you still want me to email media@ovo.com?

 

Many thanks!

Abby_OVO
Community Manager
Abby_OVO
Community Manager
Nov 5, 2026 8:10 AM UTC

Hey ​@miaowlicious 

 

I’m glad to hear that’s been picked up now by customer resolutions. I would say it can’t hurt to also still email media@ovo.com but as it’s been picked up now it’s entirely up to yourself if you want to send that second email.

Currently Playing: She's Electric
    Rank 3
    miaowliciousAuthor
    Rank 3
    Nov 13, 2026 8:09 PM UTC

    Well it’s now 9 days and no reply despite the email saying a reply within 5 working days. This is really unacceptable. I will contact the team you suggested. I won’t let this rest because that poor other customer has no idea that I now have all of her banking details. Ovo cannot just treat this as if it isn’t a massive error!

    Nukecad
    Super User
    NukecadSuper User
    Super User
    Nov 14, 2026 12:58 PM UTC

    You may be being a tad impatient, these things always take time.

    A company has 30 days to acknowledge a Data Protection Complaint.
    That’s just to acknowledge that they have received the complaint, not to resolve it.

    https://ico.org.uk/for-the-public/how-to-make-a-data-protection-complaint/#TheOrganisation

    Data protection law doesn’t set a specific time limit for the company to provide an outcome, That’s because each case is different and some will take longer than others to resolve.

    Once you do get a response (however long that takes) then if you do not consider it to be a satisfactory reply; or if you don’t get a response within a “Reasonable time*”; then you may wish to raise a complain with the ICO.

    *What’s a “Reasonable time”? I’d work on 8-weeks.
    That’s the time you have to wait with no response before you can then make a complaint to an Ombudsman, so it would seem a reasonable time to wait before complaints to the ICO as well.

    Use the “Can I complain checker on this page:

    https://ico.org.uk/make-a-complaint/data-protection-complaints/check-if-you-can-complain/

    You can report getting someone else’s information:

     

    Out of beer error >>>> Recovering memory.
      Rank 3
      miaowliciousAuthor
      Rank 3
      Nov 14, 2026 9:13 PM UTC

      Thank you for replying. I was going on the email ovo sent me which said I would receive a reply within 5 working days. 
      I wouldn’t have had that timeframe except they advised it.

      Thank again. 

      Blastoise186
      Super User
      Blastoise186Super User
      Super User
      Nov 14, 2026 4:23 PM UTC

      Also…

      If you still have that email with the bank details on, NOW might be a good time to destroy it. OVO asks that you report it and hit delete ASAP (same with any other company tbh) so keeping hold of it won’t benefit you.

      The ICO won’t want it either, so please don’t share it with them.

      Securing energy by zapping security bugs... For that is The Blastoise Way! Remember, I'm just like you - AI Powered Evil Geniuses aren't Staff!
        Rank 3
        miaowliciousAuthor
        Rank 3
        Nov 14, 2026 9:11 PM UTC

        Thanks for replying. AI told me to hang onto it, so I was doing. Won’t they want/need the customers details from me?

        Appreciate your reply.

        Terms & ConditionsAccessibility statement

        OVO Energy Ltd, Floor 5, Crescent, Temple Back, Redcliffe, BS1 6EZ, (Company no. 06890795) registered in England and Wales.

        OVO (S) Gas Limited is registered in England and Wales (Company No. 02716495) at Floor 5, Crescent, Temple Back, Redcliffe, BS1 6EZ.

        OVO (S) Gas Limited is part of OVO Group Ltd