P2 Energy Solutions data breach: what happened and what to do

Between November 8 and 17, 2021, an unauthorized party accessed files on P2 Energy Solutions' network. Notices say the files held names and Social Security numbers. Washington's Attorney General lists 573 residents of that state, and the total is larger.

View all 13,177 breaches

Breach date: 8 Nov 2021
Made public: 19 Dec 2022
Data exposed: Names, Social security numbers
Last updated: 1 Nov 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

P2 Energy Solutions is an oil and gas software and data company. In late 2022 it notified people and regulators that an unauthorized party had taken files from its network a year earlier.

What happened

P2's notices say it identified suspicious activity on certain computer systems in November 2021. A later investigation found that an unauthorized party accessed and acquired some files between November 8 and November 17, 2021. Identifying which files contained personal information took until October 2022, which is why letters reached people in December 2022.

Sources checked: oag.ca.gov, atg.wa.gov, maine.gov

Last verified against the official page: 1 Nov 2026

How we research this Report an error

What was exposed

The notices filed with state attorneys general say the information was names and Social Security numbers. P2 held some of this data for its customers, so some people were notified through those customers rather than by P2 directly. The count of 573 reported to Washington's Attorney General covers that state only, and it is not the total number of people affected.

The company's response

P2 offered one year of complimentary credit monitoring and identity theft protection through IDX and set up a toll-free call center for questions. If you received a letter, it has an enrollment code and a deadline.

What it means for you

A name and Social Security number are the core of a credit application. The main risk is new accounts or loans in your name, so a credit freeze matters more here than a password change.

What to do if you were in it

1

Freeze your credit at all three bureaus

A freeze stops new credit being opened in your name and costs nothing. Place it with Equifax, Experian and TransUnion; the FTC explains how at consumer.ftc.gov. Lift it temporarily when you apply for credit yourself.
2

Read the notice letter and use the protection it offers

If a letter arrived, it lists what was exposed and often includes free credit monitoring or identity restoration with an enrollment deadline. Sign up before that date passes.
3

Watch your statements and credit reports

Check bank and card statements for charges you don't recognize, and pull your free credit reports at AnnualCreditReport.com. If something is wrong, report it at IdentityTheft.gov and follow the recovery plan it gives you.
4

Expect phishing that mentions the breach

Scammers use news of a breach to sound legitimate. Don't click links or call numbers in unexpected texts or emails about it. Contact the company through the phone number or site on your own card or statement.
5

Check whether your email or phone is in this and other breaches

Serus monitors breach databases and the dark web and alerts you when your details appear, with steps for each case. A free scan shows where you stand today.

Official filings

Washington Attorney General , filed 19 Dec 2022 : 573 people

Timeline

8 Nov 2021
The breach happened
19 Dec 2022
The company made it public
19 Dec 2022
Reported to the Washington Attorney General

Frequently asked

Was I affected by this breach?

Check the notice letter you received. Organizations usually mail one to each person whose data was involved. If you have no letter and think your data was held, contact P2 Energy Solutions using the details on its own website.

Should I freeze my credit?

If your Social Security number or similar ID details were exposed, the FTC says a credit freeze is a free way to block new accounts being opened in your name. Place it with Equifax, Experian and TransUnion.

What should I do if I get a message about the breach?

Treat it with care. Criminals send fake breach alerts. Go to the company's own site or the number on your statements instead of using a link or number in the message.