The energy giant has warned customers of potential scam risks after almost five million accounts were affected by a cyber attack.