Social EngineeringEnergy & UtilitiesUtilitiesPhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountMediumContained

EVERSOURCE ENERGY

bd_c5622f9e262c6888 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 26, 2026

Filed

May 21, 2026

To disclose

25 days

Affected

9state residents only

Linked

5 filings

Confidence

66%

Full breach record for EVERSOURCE ENERGY →2 incidents on file

Eversource Energy notified the New Hampshire Attorney General of a phishing incident affecting approximately 9 NH residents. The attack, occurring between April 14 and April 26, 2026, compromised employee credentials to access SharePoint files containing customer PII (SSN, financial data). Eversource engaged forensic investigators, notified the FBI, and is offering 24 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 12 days

discovery → filing · 25 days

Apr 14, 2026

Begins

Apr 26, 2026

Discovered

May 21, 2026

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_160d257e6f33cfda2026-05-21Candidate
Maine State AGbd_867123e23f9768f02026-05-21Verified by operator
Vermont State AGbd_b78e35812ecebc502026-05-21Verified
Indiana State AGbd_c4e9a718e30760472026-05-27 · +6dVerified

Name: EVERSOURCE ENERGY
norm: eversource energy

Name: EVERSOURCE ENERGY
norm: eversource energy
Industry: Energy & Utilitiesllm

Discovered: Apr 26, 2026
Breach occurred: Apr 14, 2026
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 27, 2026
Affected individuals: 9state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the Federal Bureau of Investigation
Initial access: phishing_link

During the incident: Isolated and secured its systems
Investigate the incident
Retained a leading third-party forensics firm to conduct a thorough investigation, secure its systems, remediate any risks, and shutdown any unrecognized access
Alerted the Federal Bureau of Investigation and provided complete information regarding identified indicators of compromise
Changes made: Implemented additional security controls
Further strengthen its cybersecurity systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGMay 21 · first

Maine State AGMay 21 · first

Vermont State AGMay 21 · first

New Hampshire State AGMay 21 · first · this page

Indiana State AG+6d

Pattern: first filing May 21 (MA), last May 27 (IN) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/eversource-energy-20260521.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 21, 2026
Raw hash: 7549f8bd2885c34f7b2523a5aaa4edeb9858c8c6b54d3da8a5c1ad546cc287f1

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityEVERSOURCE ENERGY

Victim entityEVERSOURCE ENERGY

Incidentdiscovered Apr 26, 2026

Stated responseIsolated and secured its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov