Eversource data breach: phished employee logins, SharePoint files and an extortion email

Date	Event
April 14, 2026	First access to Eversource systems by the attacker
April 26, 2026	Extortion email sent from an employee account to a group of employees
May 5, 2026	Two more phishing attempts against employees, blocked
May 21, 2026	Reports to New Hampshire (9) and Massachusetts (284)
May 27, 2026	Letters mailed
August 27, 2026	Enrollment deadline for IDX identity protection

What happened at Eversource?

The attack came to light through the attackers' own message. On April 26, 2026, a group of employees received an email from a company employee's account saying files had been accessed and downloaded and that Eversource should contact the threat actor at a given account. The company isolated its systems, hired a forensics firm, and alerted the FBI with the indicators of compromise it had found.

The investigation traced the way in to a phishing and voice-phishing (vishing) campaign that collected employees' credentials. The letter to customers says the credentials of two employees were used to reach a limited number of files. The first access was on April 14, twelve days before the extortion email. The attackers tried to phish employees twice more on May 5, and the notice says defensive measures stopped those attempts.

Did the Eversource breach affect power or gas service?

No, according to the company. Its counsel told New Hampshire that the attack did not affect services and did not break into the customer information system, the SCADA system or critical infrastructure. What was taken was documents on SharePoint, not records pulled from the billing system.

What customer information was exposed?

The New Hampshire notice says the files held name, address, date of birth, Social Security number, financial information and account information of current or former customers, potential customers and members of their households. The customer letter adds phone number, email, driver's license number, federal identification number and financial account numbers, depending on the person. Household members are included, so someone who never held an Eversource account in their own name can get this letter.

Record	People	Data it marks
Massachusetts OCABR, report 2026-828	284	Social Security numbers, financial accounts, driver's licenses
New Hampshire DOJ notice, May 21, 2026	9	Name, address, DOB, SSN, financial and account information

What is Eversource offering?

Twenty-four months of IDX identity protection: credit monitoring, CyberScan monitoring, a $1,000,000 insurance reimbursement policy and managed identity theft recovery. The enrollment deadline was August 27, 2026. That date has passed, but a credit freeze at the three bureaus still works. Because the attack started with phishing and vishing calls, customers should also treat unexpected calls or emails about their Eversource account with care. For how these offers compare, see the credit monitoring guide.

What the documents leave open

• The name of the group behind the attack, and whether Eversource answered the extortion email.
• How many people were notified across all states in total.
• How many files were downloaded.