Website Security for UK Energy Consultants and Brokers

Why Energy Consultants Face Distinct Cyber Risk

Energy consultants and brokers operate at the intersection of sensitive commercial data and significant financial transactions. A business energy contract is worth thousands or tens of thousands of pounds annually — the kind of value that makes the data surrounding it attractive to fraudsters.

The sector has also attracted regulatory attention. Ofgem and the Information Commissioner's Office both have an interest in how customer data is handled by energy intermediaries, and the complaints-driven nature of the market means a data incident has reputational as well as regulatory consequences.

What Energy Consultant Websites Hold

**Commercial client data** — Business names, registered addresses, trading addresses, company registration numbers, VAT numbers, and the names and direct contact details of decision-makers. This is detailed commercial intelligence.

**Utility account information** — Meter point reference numbers (MPANs/MPRNs), consumption data, current supplier details, and contract end dates. This data is used to manipulate supplier switching fraudulently if it falls into the wrong hands.

**Letter of Authority documentation** — LOAs signed by clients authorising the consultant to act on their behalf give the holder significant power to manage energy accounts. These documents, stored without adequate access controls, represent direct financial risk.

**Comparison and quotation data** — Pricing data from supplier portals and proprietary comparison tools is commercially sensitive. Supplier portal credentials are particularly high value.

**Financial information** — Commission structures, client invoicing, and procurement savings calculations contain commercially sensitive information clients have shared in confidence.

Common Security Issues

**Exposed document storage** — LOAs, contracts, and energy audit reports are frequently stored in web-accessible directories without authentication. A direct URL to a document folder can expose the entire client document library.

**Supplier portal credentials in browser-accessible code** — API integrations with supplier quoting portals sometimes embed credentials in JavaScript or configuration files served to the browser. These credentials give access to live pricing data and sometimes customer account management.

**Weak CRM access controls** — Client management systems accessed through the web without multi-factor authentication are vulnerable to credential attacks. A compromised CRM gives an attacker access to every client record and their utility account details.

**Phishing risk from contact forms** — Detailed contact and enquiry forms on energy consultant websites are used by fraudsters to research targets for invoice fraud and business email compromise — impersonating the consultant or a supplier to redirect payments.

**No rate limiting on quote request forms** — Quote forms that accept meter reference numbers without rate limiting can be abused to enumerate utility account details for businesses across a postcode area.

Regulatory Considerations

Energy intermediaries are subject to Ofgem's rules on transparency and consumer protection. A data breach that exposes client commercial data or LOA documentation has regulatory implications beyond ICO reporting requirements.

Under UK GDPR, the energy data you hold for commercial clients — particularly consumption data and utility account references — is personal data where the client is a sole trader or partnership. The same GDPR obligations that apply to consumer data apply here.

Yrzo AI scans energy consultant websites and identifies exposed document stores, weak authentication on client portals, and credentials that may be accessible through browser-side code — the vulnerabilities most likely to cause regulatory or financial harm in this sector.