UtilitiesTop story
State consumer counsel says Eversource missed a data breach for almost two weeks
Eversource didn't identify the attack for almost two weeks
- Apr. 14The attacker starts the cyberattack on Eversource.
- Apr. 27Eversource becomes aware of the attack, the OCC report says.
- May 6The attacker's access reaches four employees.
- May 22Eversource says it found unauthorized activity using phished employee credentials.
- Nov. 13The OCC files its report with PURA and calls for an audit.
Sources: WTNH.com, Westfair Communications, NBC Connecticut
If you pay an Eversource bill, this one's for you. The state's Office of Consumer Counsel (OCC) filed a report with PURA saying Eversource didn't identify an April cyberattack for almost two weeks. The attacker downloaded more than 3.6 million files, including Social Security numbers and income information.
Consumer Counsel Claire Coleman wants PURA to require an independent cybersecurity audit, paid by shareholders, not through monthly bills. She says the warning to customers lacked urgency. Eversource says it has “stringent policies and procedures” to protect customer information.
- Eversource's May count: about 3,049 customers or household members
- Free from Eversource: two-year credit monitoring and identity theft restoration
- Identity theft reports: none to Coleman so far, among nearly 3,000 victims
The OCC counts millions of files and few sign-ups
- 3.6 million
- files downloaded, the OCC report says
- 2,592
- Connecticut ratepayers whose files were exposed, Westfair reports
- 6%
- signed up for monitoring services, per the OCC
Sources: Westfair Communications, NBC Connecticut
“Even if your Social Security number is breached, you can go ahead to any one of the three major credit reporters and freeze your credit.”
Marshall Darling, Quinnipiac University cybersecurity professor
