State agency requesting Eversource be audited for handling of April data breach

Did Eversource do enough to protect customers from, and warn them about, a data breach? The Connecticut Office of Consumer Counsel (OCC) doesn’t think so.

The situation dates back to April 14, when an attacker breached Eversource and eventually customer data. More than 10 days later, Eversource learned of the cyberattack, according to OCC.

It wasn’t until a month later that the company sent out a news release and notified employees. Five days after that, customers received letters, according to OCC.

One of the biggest concerns from OCC is that customers weren’t notified in time to make changes before their data was compromised.

“We think this should have been sort of shouted from the rooftops very loudly so that customers know this is not just a routine communication,” Claire Coleman of the Office of Consumer Counsel said.

Nearly 3,000 Eversource customers in the “financial hardship program” had tax returns, bank statements, pay stubs, Social Security numbers, and benefits information breached when Eversource was attacked in April.

“More steps should have been taken to ensure that employees were aware that this wasn’t going to happen again and that customers were fully protected,” Coleman said.

The OCC is calling for an audit into Eversource’s cybersecurity measures and response protocols.

Its report indicates Eversource knew about the breach for a month before the company told employees. The OCC says the delay allowed multiple employees to fall victim to phishing attempts in the meantime.

Customers didn’t receive letters until five days after employees, with only 6% signing up for monitoring services.

“We didn’t feel like that information was relayed with the sense of urgency that it should have; we felt like customers may not have taken advantage of those services,” Coleman said.

“You can have the best systems, processes, and policy in place, but if your people are not trained to not fall for phishing or simple email tricks, those systems and processes will fail,” Quinnipiac University cybersecurity professor Marshall Darling said.

Coleman says she has not been notified of any of the nearly 3,000 victims experiencing identity theft from the breach.

But Darling says the data is already out there, and it’s not too late to lock down your information.

“Even if your Social Security number is breached, you can go ahead to any one of the three major credit reporters and freeze your credit,” Darling said. “Totally recommend people rotate their passwords.”

Eversource provided the following statement to NBC Connecticut:

Cybersecurity and the protection of customer information is a fundamental component of providing the safe, reliable energy services our people, businesses and communities need. We have stringent policies and procedures in place to protect against constantly evolving cyber threats, and we are regularly refining those protections to maintain vigilance on this critical issue.

Since this specific issue came to light in the spring, we’ve been in regular communication with our regulators and local and federal law enforcement, and we will continue to focus as always on the necessary collaboration with those key stakeholders as part of our never-ending process to protect customer information.

State agency requesting Eversource be audited for handling of April data breach

Comments