The U.K. energy company said a redirected payment meant for a contractor instead landed in a hacker's bank account.