Conn. (WTNH) — The State of Connecticut Office of Consumer Counsel (OCC) filed a report with the Public Utilities Regulatory Authority (PURA) claiming that Eversource did not identify a cyberattack against its customers’ information for almost two weeks
The OCC report states that the attacker downloaded over 3.6 million files of customers’ personal data, including their Social Security numbers and those of their family members, their family’s income information, customers’ contact information, and customers’ government benefits information.
Go green! Recycling dos and don’ts ahead of National Recycling Day
The report says that the attack continued for more than three days after Eversource was notified of the attack, which was only because the company was contacted by the attacker.
The attack started on April 14, with the attacker gaining access through one employee, increasing that number to four by May 6. Eversource did not become aware of the attack until April 27.
OCC reported to PURA its concerns that Eversource did not immediately stop the attacker’s access to files once it had become aware of the situation.
“This indicates either a lack of capacity to protect its own system or a lack of seriousness concerning cybersecurity issues, or both,” the report said.
The OCC report also states that Eversource does not have a full picture of how the data breach occurred, and did not alert its employees or customers of the breach in a timely fashion.
Eversource sent out a statement on May 22 that it had identified “unauthorized activity involving employee credentials obtained through phishing and social engineering attacks.”
Eversource said Friday in a statement to News 8:
“Cybersecurity and the protection of customer information is a fundamental component of providing the safe, reliable energy services our people, businesses and communities need. We have stringent policies and procedures in place to protect against constantly evolving cyber threats, and we are regularly refining those protections to maintain vigilance on this critical issue.
“Since this specific issue came to light in the spring, we’ve been in regular communication with our regulators and local and federal law enforcement, and we will continue to focus as always on the necessary collaboration with those key stakeholders as part of our never-ending process to protect customer information.”
Read the full OCC report below:
Copyright 2026 Nexstar Media, Inc. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.For the latest news, weather, sports, and streaming video, head to WTNH.com.
