HackingEnergy & UtilitiesUtilitiesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

FIVE STATES ENERGY COMPANY, L.L.C.

bd_f089861523f7f475 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 12, 2026

Filed

Apr 2, 2026

To disclose

7 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

66%

Full breach record for FIVE STATES ENERGY COMPANY, L.L.C. →

Five States Energy Company, L.L.C. detected a network compromise on February 12, 2026, impacting personal information including names, SSNs, bank account numbers, and contact info. The company engaged forensic experts, notified law enforcement, and provided 24 months of credit monitoring. Approximately 4 Vermont residents were identified as potentially affected.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 7 weeks / 49 days

Feb 12, 2026

Discovered

Apr 2, 2026

Filed

This filing is one of 9 about the same incident.View merged incident

A leak claim by dragonforce about this victim predates this filing by 49 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitedragonforcebd_10e7db3f7644f4062026-02-19 · +41dVerified by operator
Leak Sitedragonforcebd_e39e6d2fa52a6db32026-02-12 · +49dVerified by operator

Regulatory filings (6) · sorted by filing gap

New Hampshire State AGbd_8611858ddbd143652026-04-02Verified
Maine State AGbd_fdec22ccffee3a4f2026-04-02Verified
Texas State AGbd_946f8dbde8d6f2b42026-04-06 · +4dVerified
Nebraska State AGbd_ceaac5224b961c9e2026-03-26 · +7dVerified by operator

Show 2 more filings ↓up to 106d gap

Indiana State AGbd_cf6cb656efb1ddef2026-03-26 · +7dCandidate
Massachusetts State AGbd_e8d95536a0c570492026-07-17 · +106dVerified

Name: FIVE STATES ENERGY COMPANY, L.L.C.
norm: five states energy
Domain: fivestates.com

Name: FIVE STATES ENERGY COMPANY, L.L.C.
norm: five states energy
Domain: fivestates.com
Industry: Energy & Utilitiesllm

Discovered: Feb 12, 2026
Materiality determined: —
Notification sent: Mar 26, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified and communicated with law enforcement regarding this incident
Initial access: valid_credentials

During the incident: Initiated incident response immediately to address the source of the compromise
Completed an assessment to confirm the ongoing security of our systems
Engaged additional third-party experts
Notified and communicated with law enforcement regarding this incident
Changes made: Continuously enhancing systems’ security to prevent a similar event from occurring in the future
Focused on continuous awareness training and assessment of our data security
Providing access to free credit monitoring through Cyberscout, a TransUnion company for twenty-four (24) months
Providing proactive fraud assistance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: VT AG >14 bdayLeak >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Nebraska State AGMar 26 · first

Indiana State AGMar 26 · first

New Hampshire State AG+7d

Maine State AG+7d

Vermont State AG+7d · this page

Texas State AG+11d

Massachusetts State AG+113d

Pattern: first filing Mar 26 (NE), last Jul 17 (MA) — a 113-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2026-04-02-five-states-energy-company-llc-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 2, 2026
Raw hash: e806199181555d2c67743685644ff0107b4d2df11aeaa7dda935bd0cfacd1359

Linked disclosures

Ransomware claims (2)

Regulatory filings (6) · sorted by filing gap

Reporting entityFIVE STATES ENERGY COMPANY, L.L.C.

Victim entityFIVE STATES ENERGY COMPANY, L.L.C.

Incidentdiscovered Feb 12, 2026

Stated responseInitiated incident response immediately to address the source of the compromise

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov