Eversource Energy has disclosed a cyber incident that exposed personal information belonging to 3,049 customers across Connecticut, Massachusetts, and New Hampshire after attackers compromised the accounts of two employees through phishing and social engineering tactics.
The utility provider said the unauthorized access occurred in April and was quickly detected and contained.
According to the company, the incident did not affect electric, gas, or water services and did not impact operational technology systems or critical infrastructure.
Customer information accessed through employee accounts
Eversource said its investigation determined that threat actors gained access to limited company data through two compromised employee accounts.
The information exposed varies by individual but may include names, mailing addresses, service addresses, account details, phone numbers, email addresses, Social Security numbers, driver’s license numbers, and financial account information.
The company has notified affected customers and relevant regulators and law enforcement agencies.
Phishing remains a persistent utility sector threat
The incident stemmed from phishing and social engineering techniques rather than a direct compromise of Eversource’s customer platforms or operational infrastructure.
Utilities remain attractive targets because they maintain large volumes of customer information while operating services considered critical infrastructure.
Organizations across multiple sectors continue to face attacks that rely on credential theft and employee deception rather than sophisticated exploitation of technical vulnerabilities.
Credit monitoring offered to affected customers
Eversource said it has blocked the unauthorized access, implemented additional security measures, and is offering 2 years of complimentary credit monitoring and identity theft restoration services to affected individuals.
The disclosure follows continued cybersecurity challenges across the energy and utility sector, including incidents involving customer databases, credential exposure, and phishing-driven compromises.
BreachNews previously reported on an alleged breach affecting iGreen Energy that exposed utility-related customer information.
Organizations seeking to reduce phishing risk can review our guide on defending against social engineering attacks in the workplace.
