In April 2026, Eversource Energy was the victim of a phishing campaign that compromised the credentials of two employees. This unauthorized access led to a data breach disclosed through a Maine Attorney General filing on May 21, 2026.
The breach affected approximately 3,049 individuals and potentially exposed data including names, mailing and utility service addresses, account information, phone numbers, email addresses, Social Security numbers, driver’s license numbers, federal identification numbers, financial account numbers, dates of birth, government IDs, and medical information. Eversource is providing 24 months of identity protection services through IDX to those affected. The full scope of affected states remains unclear, though Eversource operates in Connecticut, Massachusetts, and New Hampshire. While a lawsuit investigation page exists, a confirmed filed class action complaint has not been found in the provided sources.
More details may emerge as investigations continue and notices are distributed.