Consumer Counsel Coleman Calls for Independent Audit Following Eversource Data ...

Consumer Counsel Coleman Calls for Independent Audit Following Eversource Data Breach Investigation

With more than 3.6 million files accessed and personal information of 2,592 Connecticut ratepayers exposed, OCC calls for independent cybersecurity audit at shareholders’ expense

– Today, Consumer Counsel Claire Coleman is calling for an independent review of Eversource Energy’s cybersecurity practices, at shareholder’s expense, following an investigation into the company’s handling of an April 2026 data breach in which almost 2.5 million unique (and more than 3.6 million total) company files were accessed, exposing sensitive personal and financial information belonging to 2,592 Connecticut ratepayers.

In a report filed today with the Public Utilities Regulatory Authority (PURA), the Office of Consumer Counsel (OCC) details serious failures in Eversource’s cybersecurity systems, response procedures and communications to employees and affected customers following an investigation of the breach. Based on the report’s findings, Coleman urges regulators to consider the company’s response as part of Eversource’s pending electric distribution rate case and to require a comprehensive, independent cybersecurity audit, with associated costs borne by shareholders, not ratepayers. Coleman also encourages the legislature to take up stronger data privacy protections for utility consumers in the upcoming session.

“The safety and security of sensitive customer data is entrusted to our utility companies. While a data breach is inherently a mistake, companies can respond in a way that demonstrates managerial competence and concern for customers. Neither is evident in Eversource’s actions following the incident. Evidence indicates that for nearly two weeks in April, an unauthorized third-party accessed millions of company files without Eversource’s knowledge. After being alerted of the data breach by the third party, unauthorized access to company and customer information continued, additional employee accounts were comprised, and Eversource took a month before notifying affected customers. Consumer protections, especially as they relate to data and personal information, are more important now than ever before. That’s why OCC is calling for appropriate regulatory action and for Eversource management to put its responsibility to customers ahead of the company’s bottom line,”

, a proceeding that began as a review of the cybersecurity practices and procedures of public service companies and evolved into an investigation of Eversource’s data breach, details Eversource’s significant cybersecurity and communication lapses, the type of sensitive customers information that was exposed, and recommendations to PURA to require an independent audit and accountability measures in Eversource’s pending rate case proceeding in

Significant Cybersecurity and Communication Failures

The cyberattack began on April 14, 2026, when a third party gained unauthorized system access through an Eversource employee account, followed by a second compromised account on April 17. Eversource became aware of the attack on April 27 when the attacker used a compromised employee email account to notify the company. Unauthorized access continued through April 30, with more than 3.6 million company files accessed over the April 14-30 period.

Additional employee accounts were compromised on May 5 and May 6, with the attacker again notifying Eversource of the May 6 access through a compromised employee email account. According to OCC’s report, significant questions remain unanswered how the attacker gained access to employee accounts, obtained employee information and triggered a valid Microsoft Authenticator notification.

Sensitive Information of Financial Hardship Customers Exposed

The cyberattack exposed personal information belonging to 2,592 Connecticut residents. All of these customers are associated with Eversource’s financial hardship programs and the information compromised may include tax returns, bank statements, paycheck stubs, Social Security numbers and government benefits information. Eversource learned of the attack on April 27, yet a notice to employees, as well as a public press release, was not sent until May 22. Affected customers did not receive notification letters until May 27, one month after Eversource first became aware of the breach.

OCC’s report raises concerns the adequacy of Eversource’s communication the attack, noting deficiencies in the company’s communication of the scope and seriousness of the attack to help affected customers protect themselves. Of the 2,592 affected Connecticut residents, only six percent of the affected customers, or approximately 156 customers, enrolled in the identity and credit monitoring services required to be offered by Eversource following the breach. The deadline for enrollment expired on August 27, 2026.

Independent Audit and Rate Case Accountability

In the report, OCC recommends PURA require Eversource to commission a comprehensive, independent cybersecurity audit, paid for by shareholders. OCC maintains that Connecticut customers have already borne the costs and consequences of this data breach and should not pay for the cost of an audit addressing cybersecurity deficiencies, that prudent management should have identified and corrected, through monthly electric bills.

OCC also urges regulators to consider the impact of the report’s findings and unresolved questions in Eversource’s pending electric distribution rate case, Docket No. 26-05-10, in which the company is seeking approximately $451 million in additional annual revenue, a roughly 50 percent increase in the distribution portion of customers’ monthly bills.

Finally, during the upcoming legislative session, OCC will advocate stronger data protection for utility consumers, including by expanding the Connecticut Data Privacy Act to include the protection of confidential utility account information.

The Office of Consumer Counsel (OCC) is an independent state agency that represents the interests of consumers of Connecticut’s electric, natural gas, telecommunications, and private water companies before PURA, federal regulatory agencies, the legislature and courts. OCC’s team of attorneys, accountants, financial and policy analysts appear before PURA to argue for the most reasonable rates while expecting the best utility service possible for all customers.