Eversource Energy didn’t know a hacker was copying its files for nearly two weeks this spring until the intruder emailed the company from a compromised employee account, a state report filed Friday says.
Nine days later, it happened again.
The Office of Consumer Counsel’s report to the Public Utilities Regulatory Authority draws largely on information Eversource gave investigators. It details how the breach unfolded, including repeated phishing attacks that fooled employees into giving up login credentials.
The first attack began April 14, when an employee received a text message with a link to what appeared to be a company login page. The employee entered a username, password and verification code on the fake page, giving the attacker access to their account, according to an incident report Eversource filed with PURA in August.
For the next 13 days, the attacker copied files from the company’s Microsoft cloud storage without Eversource detecting the activity, OCC said.
Then, at about 10:15 a.m. on April 27, the attacker used the first employee’s account to send the company two emails and a Microsoft Teams message. The messages claimed the sender had company files, executive emails and employee account information, and told Eversource to contact the attacker, the company’s report says.
Eversource locked that employee’s account within minutes. But it didn’t discover a second compromised account until April 30, according to its own timeline. That account had been compromised since April 17, and the attacker continued copying files through it in the meantime, OCC said.
In total, more than 3.6 million files were accessed. Some contained personal information belonging to 2,592 Connecticut residents, all tied to Eversource’s financial hardship programs. OCC said the records likely included Social Security numbers, tax returns and bank statements.
The attacks continued in May.
On May 5, a caller posing as tech support tricked a third employee into entering information into what the employee believed was a chat window. That allowed the attacker to access the employee’s account.
A new security detection rule flagged the intrusion, but Eversource did not lock the account until more than eight hours after the attacker logged in, OCC said.
The following day, a caller using what appeared to be an Eversource phone number persuaded a fourth employee to enter login credentials on a fake website. The company learned of the intrusion 23 minutes later, when the attacker used the employee’s account to email several company security distribution lists.
Eversource says the attacker was not able to access any data through the third and fourth employees’ accounts. It told its general workforce about the attack on May 22 and mailed notices to affected customers on May 27, a month after it learned of the breach.
In its incident report, Eversource described the attack by an organized criminal group as “a relatively narrow incursion” that did not affect electric or gas service or reach customer information systems. The company said it contacted the FBI on April 27, has added security controls and expanded employee training, and that its response team “was highly effective and responded quickly.”
Consumer Counsel Claire Coleman, whose office represents ratepayers before PURA, disagreed.
“While a data breach is inherently a mistake, companies can respond in a way that demonstrates managerial competence and concern for customers,” she said. “Neither is evident in Eversource’s actions following the incident.”
Only 156 of the affected Connecticut residents enrolled in free identity protection Eversource offered before the Aug. 27 deadline, OCC said.
Coleman is asking PURA to order an independent cybersecurity audit at shareholders’ expense and to weigh the breach in Eversource’s pending electric rate case.
She also plans to ask lawmakers to extend the state’s data privacy law to cover utility account information. Last month, Coleman and Attorney General William Tong asked PURA to review utilities’ cybersecurity and use of artificial intelligence.
Click Here For The Original Source.
——————————————————–
