State consumer counsel calls for independent audit of Eversource data breach probe - Westfair Communications
State Consumer Counsel Claire Coleman has called for an independent review of Eversource Energy's cybersecurity practices following an investigation into the company's handling of an April 2026 data breach that exposed sensitive information of thousands of customers.
In a report filed with PURA, the OCC details serious failures in Eversource's cybersecurity systems, response procedures, and communications following an investigation of the breach. The breach exposed more than 3.6 million company files with sensitive personal and financial information belonging to 2,592 Connecticut ratepayers.
Breach Timeline
The cyberattack began on April 14, 2026, when a third party gained unauthorized system access through an Eversource employee account, followed by a second compromised account on April 17. Eversource became aware of the attack on April 27 when the attacker used a compromised employee email account to notify the company.
Unauthorized access continued through April 30, with more than 3.6 million company files accessed over the April 14-30 period. Eversource took a month before notifying affected customers.
Company Response
In May, Eversource issued a statement confirming no impact to electric, gas or water service, and no intrusion into customer information systems or critical operational systems. The company stated that some data accessed included personal information associated with approximately 3,049 former or current customers.
Eversource takes cybersecurity and the protection of customer information very seriously and will continue to remain vigilant and take appropriate measures to protect against cyber threats and further harden our systems.
Regulatory Action
The OCC recommends PURA require Eversource to commission a comprehensive, independent cybersecurity audit, paid for by shareholders. The agency maintains that Connecticut customers have already borne the costs and consequences of this data breach and should not pay for addressing cybersecurity deficiencies that prudent management should have identified.
Coleman urges regulators to consider the company's response as part of Eversource's pending electric distribution rate case and encourages the legislature to take up stronger data privacy protections for utility consumers in the upcoming session.
Related
