Verified Canadian Homeowners’ EnerHome CRM Data Leak

Data Breach Summary

A significant data breach has exposed over 2,297 CRM records from EnerHome Consulting (domain: enerhomeconsulting.ca), a company involved in federal energy rebate programs such as Greener Homes and CSGC. The leaked information pertains to verified Canadian homeowners from Ontario, Alberta, and British Columbia, with all records collected between July 19–22, 2025.

The exposed dataset contains sensitive personal details, including names, full residential addresses, contact information, contractor references, and internal notes on eligibility, assessment status, and preferred installation types. The source appears to be EnerHome’s live, unencrypted internal CRM system.

---

Where and How?

The breach was identified on a dark-web marketplace, where the dataset was being offered in full. The records represent genuine homeowner applications submitted via official booking forms on EnerHome Consulting’s website. Each entry contains comprehensive project details, such as installation dates, contractor information, and office comments, making the data highly exploitable for fraud, phishing, or unauthorized marketing.

The availability of such sensitive information raises concerns over the security of internal CRM systems handling personal data for government-linked programs.

Company Data Breach History

A search found no confirmed previous breaches involving EnerHome Consulting. However, a recent post on social media highlighted the presence of the leaked CRM dataset in underground forums, suggesting a possible vulnerability in the company’s systems that requires immediate attention.

---

Further Action

EnerHome Consulting should promptly secure its CRM infrastructure, conduct a full forensic investigation to identify the breach source, notify affected individuals, and coordinate with relevant Canadian privacy regulators. Transparent communication and rapid remediation will be critical to regaining public trust.

---

Recommendations for Personal Data Protection

To mitigate risks, affected individuals are advised to:

• Change passwords associated with their accounts.
• Enable two-factor authentication wherever possible.
• Monitor bank statements, credit reports, and accounts for suspicious activity.
• Be cautious of phishing emails or unsolicited calls referencing energy rebate programs.
• Avoid reusing the same password across multiple platforms.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.