Library, Fitness & Home · Solar/Home Services · Data breach
Sunrun
Headline
The January 2017 breach came from a hacker impersonating Sunrun's CEO to obtain employee data - a business email compromise, which is social engineering again, and again requiring no technical exploit.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The January 2017 breach came from a hacker impersonating Sunrun's CEO to obtain employee data - a business email compromise, which is social engineering again, and again requiring no technical exploit. The consumer-facing note for residential solar generally is that these are 20-to-25-year agreements, frequently involving leases or power purchase agreements that attach to the property and must be assumed by a buyer, and the company holds detailed household energy production and consumption data for the entire term. That is the smart-meter inference problem documented in the Power Utilities tab, held by a private company with no utility regulator over it.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Sunrun's Terms of Service contain MANDATORY BINDING ARBITRATION (AAA Commercial Rules) with an EXPLICIT CLASS-ACTION AND CLASS-ARBITRATION WAIVER — customers must resolve disputes individually. One consumer-advocacy source notes arbitration 'might be the only option available' to a Sunrun customer depending on their specific contract, underscoring how thoroughly the clause forecloses collective action.
Data sharing
HISTORICAL EMPLOYEE-DATA BREACH (January 20, 2017, per Courthouse News): a hacker impersonating Sunrun CEO Lynn Jurich emailed the payroll department and obtained employee W-2 tax forms (SSNs, addresses, salaries); Sunrun offered 2 years of Experian ProtectMyID monitoring, and an employee class action filed Feb. 9, 2017 in San Francisco Superior Court alleges Sunrun did NOT reimburse employees for costs from fraudulent tax returns already filed using the stolen data — an employee-facing breach, not customer-facing.
Fees and billing
MULTIPLE STATE ATTORNEYS GENERAL ACTIONS (2024-2026), among the most serious consumer-protection findings in this entire tab: Connecticut AG William Tong SUED Sunrun (July 2024; still described as an active lawsuit on AG Tong's website, no resolution found as of Oct 2026) along with door-to-door sales contractors Bright Planet Solar and Elevate Solar, alleging sales reps FORGED a customer's electronic signature (with her name's initials reversed), then IMPERSONATED HER VOICE on a confirmation call to finalize a 25-year, $306.98/month solar lease she had TWICE explicitly rejected — Sunrun then installed a 36-panel system without consent and refused to remove it. Texas AG Ken Paxton separately issued civil investigative demands (April 2026) to Sunrun over alleged misrepresented energy-bill savings and contract terms. Massachusetts logged 170+ consumer complaints against Sunrun (2023-2025) — more than any other solar company in the state. Nationally, Sunrun has reportedly drawn thousands of BBB complaints (the 4,000+ figure was not re-verified), and consumer class actions have alleged customers were misled into believing bills would drop or disappear, only to end up paying BOTH their utility bill AND the Sunrun lease. CANCELLATION PENALTIES reportedly range from $1,500 to over $10,000 depending on years remaining on the contract.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy sunrun.com/legal/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service sunrun.com/sunrun-terms-of-service | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.