AccidentalEnergy & UtilitiesUtilitiesMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDMediumContained

NSTAR ELECTRIC COMPANY

bd_6b5cd1378c070015 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 16, 2021

Filed

Apr 16, 2021

To disclose

4 weeks

Affected

128state residents only

Linked

2 filings

Confidence

67%

Full breach record for NSTAR ELECTRIC COMPANY →

NSTAR Electric Company (dba Eversource Energy) reported a security incident to the New Hampshire Attorney General on April 16, 2021. On March 16, 2021, the company discovered an Azure cloud storage folder was misconfigured, allowing potential public access. The folder contained personal information (names, addresses, SSNs, utility account info) for 128 New Hampshire residents who had Massachusetts service addresses. No financial account data was involved. The company restricted access immediately, investigated, and found no evidence of unauthorized access or misuse. Notices were sent to affected residents, who were offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 31 days

Mar 16, 2021

Discovered

Apr 16, 2021

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_374aefa44fcf06b12021-04-16Verified

Name: NSTAR ELECTRIC COMPANY
norm: nstar electric

Name: NSTAR ELECTRIC COMPANY
norm: nstar electric
Also named: NSTAR Electric Companydba oflegal entity
Eversource Energydba oftrade name
Industry: Energy & Utilitiesllm

Discovered: Mar 16, 2021
Materiality determined: —
Notification sent: Apr 16, 2021
Affected individuals: 128state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1078 Valid Accounts
Regulator citations: Reported security incident to New Hampshire Attorney General

During the incident: Immediately restricted access to the folder
Undertook a full investigation
Strengthened the protection of customer information
Reviewed and updated security controls for shared files
Reviewed and updated related policies and procedures
Made immediate enhancements to its system security and procedures
Conducted a review of security practices
Sent notices to affected New Hampshire residents
Arranged credit monitoring and identity protection services by CyberScout
Changes made: Reviewed and updated security controls for shared files
Reviewed and updated related policies and procedures
Made immediate enhancements to its system security and procedures
Conducted a review of security practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGApr 16 · first

New Hampshire State AGApr 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/nstar-electric-20210416.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 16, 2021
Raw hash: ccc21e96517e4c10d12b2ca97a96395e1fba3001633aa26b7794dc0015e53f09

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNSTAR ELECTRIC COMPANY

Victim entityNSTAR ELECTRIC COMPANY

Incidentdiscovered Mar 16, 2021

Stated responseImmediately restricted access to the folder

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov