Apex Clean Energy Holdings, LLC, a renewable energy company headquartered in Charlottesville, Virginia, has reported a data security incident to the Texas Attorney General. The filing says personal information, including Social Security numbers and medical details, was affected.
Any company that collects sensitive personal data from employees, contractors and business contacts has a responsibility to protect it. This page summarizes what the public record shows so far.
Apex Clean Energy Holdings, LLC’s Data Breach Investigation
On November 3, 2026, the Texas Attorney General’s office published a data security breach report naming Apex Clean Energy Holdings, LLC, with an address on Garrett Street in Charlottesville, Virginia. Texas requires organizations to report certain breaches to the state when they involve Texas residents, and the office posts those reports in a public listing. The entry for Apex Clean Energy is the main public source of information about this incident.
According to that entry, 1,387 Texans were affected. That figure counts only Texas residents. Companies that operate in many states often notify people in each state separately, so the total number of people affected nationwide may be higher, and Apex Clean Energy has not published a total. The entry also says notice was provided to consumers, and that it was sent by U.S. Mail. People who were affected may therefore have received a letter by now or may receive one soon.
The Texas record lists several categories of information affected. They are names, Social Security numbers, driver’s license numbers, government-issued identification numbers such as a passport or state ID card, financial information such as bank account or credit or debit card numbers, medical information, and health insurance information. The record does not say which categories apply to which person. In most breaches the mix varies by individual, so one person may have had only a name and a Social Security number involved while another had a longer list.
The Texas entry does not explain what happened. It does not say whether the cause was a network intrusion, a ransomware attack, a phishing email, a mistake by an employee or a problem at a vendor. It also does not give the dates when the incident took place or when Apex Clean Energy found out about it. A search for a separate public statement from the company turned up nothing at the time this page was written, so those details are not known. This page does not guess at them.
The mix of data types gives some clues about who may be affected, though only as general background. Medical and health insurance information is not typically collected from customers of an energy developer. It is more commonly held for people on an employer’s benefits plans, such as current and former employees and their family members. Driver’s license and government ID numbers are often collected for hiring, background checks and site access. These are observations about how companies in general handle data, not confirmed facts about who in particular was affected here.
Social Security numbers and financial account details are among the most sensitive kinds of personal information. Unlike a password, a Social Security number cannot easily be replaced, and it can be used to open new accounts, file false tax returns or apply for credit in someone else’s name. Medical and insurance details can be used for medical identity theft, where a criminal obtains care or files claims using a stolen identity. A government ID number gives scammers material that makes impersonation more convincing.
The practical risk after a breach like this is usually not immediate. Stolen data can be used or sold months after the original incident, and scam messages that cite real details can look believable. People who get a notice letter should read it closely, note any offer of credit monitoring or identity protection and its enrollment deadline, and keep the letter. People who have worked for, applied to, or done business with Apex Clean Energy and have not received a letter can still watch their accounts and credit reports.
If Apex Clean Energy later publishes a fuller notice, files with other state attorneys general or releases details about the cause and timeline, those sources will be the most reliable basis for understanding the scope of the incident. Until then, the Texas filing is the only confirmed information, and this page will reflect what the public record supports.
When Did This Breach Occur?
The Texas Attorney General’s office published the report on November 3, 2026. The filing does not list the date the incident happened or the date Apex Clean Energy discovered it, and the company has not published a timeline of its own.
Because the notice was sent by mail, the letters would typically be dated shortly before the report was posted. Breach notice letters usually state both the dates of unauthorized activity and the date the company learned of it, so the letter is the best source for those facts.
What Information Was Breached?
The Texas record lists names, Social Security numbers, driver’s license numbers, government-issued ID numbers, financial information such as account or card numbers, medical information, and health insurance information.
The filing does not break these down by person, so not everyone affected necessarily had every type of information involved. Your notice letter, if you receive one, should say which items related to you.
What You Can Do
If you received a notice from Apex Clean Energy or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for credit monitoring or identity protection it offers.
- Place a free fraud alert or credit freeze with Equifax, Experian and TransUnion, and get your credit reports free at annualcreditreport.com.
- Review bank and card statements, and your health insurance explanation of benefits, for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Apex Clean Energy Holdings, LLC
If you received a notice from Apex Clean Energy Holdings, LLC, you may have legal options. A data breach lawsuit can seek compensation for the loss of privacy, the time spent protecting yourself and any out-of-pocket costs, and can press a company to improve how it safeguards personal information. Whether a claim makes sense depends on the facts of the incident, which are still limited. Keep your notice letter and any records of suspicious activity or expenses, since they may matter later.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
