Attorneys at Almeida Law Group are investigating whether a class action lawsuit can be filed on behalf of individuals affected by a possible Eversource Energy data breach. According to dark web monitoring sources, a hacker group calling itself Redact claimed responsibility for a cyberattack on Eversource Energy in a post first observed in October 2026, alleging it had gained access to internal company systems. As of this writing, Eversource Energy has not issued a public confirmation of the incident, and the exact scope of any exposed data remains unknown. If you believe you were affected, contact Almeida Law Group.
About Eversource Energy
Eversource Energy (NYSE: ES) is a Fortune 500 public utility holding company and the operator of New England’s largest energy delivery system. Headquartered in Connecticut and Massachusetts, the company transmits and delivers electricity, natural gas, and water to approximately 4.4 million customers across Connecticut, Massachusetts, and New Hampshire. It operates through Electric Distribution, Electric Transmission, and Natural Gas Distribution segments and employs approximately 10,000 people.
What Happened?
Eversource Energy was listed in a ransomware leak-site allegation reported by Ransomware.live. On October 12th, 2026, the Redact ransomware group posted a claim on its dark-web leak site alleging that it had exfiltrated 3.8 terabytes of data from Eversource Energy. The post described the victim as operating in the energy distribution sector with approximately $14 billion USD in annual revenue. No independent corroborating source has been found to confirm this claim, and Eversource has not publicly acknowledged the incident. The data types involved in this alleged breach have not been confirmed. The Redact group’s statements are attacker-side allegations only and should not be taken as verified fact.
This October 2026 claim must be distinguished from a separate, company-confirmed incident. In April 2026, Eversource confirmed that a phishing campaign on April 14th, 2026 compromised the credentials of two employees, allowing unauthorized access to a limited number of files. That breach was discovered on April 27th, 2026, and Eversource notified approximately 3,049 affected individuals beginning May 27th, 2026. Data exposed in that confirmed phishing breach included names, mailing and utility service addresses, account information, phone numbers, email addresses, Social Security numbers, driver’s license numbers, federal identification numbers, and financial account numbers. It is currently unknown whether the Redact group’s October 2026 claim relates to that confirmed incident or represents an entirely separate intrusion.
Redact is a cybercrime group that emerged in May 2026. It focuses on non-encrypting data extortion and employs voice phishing, identity compromise, and real-time multi-factor authentication bypass tactics. The group has also claimed other victims, including Graybar Electric and DexCom. Eversource has a documented history of prior security incidents, including a 2021 breach caused by a misconfigured cloud storage server that exposed the personal information of approximately 11,000 eastern Massachusetts customers, and a 2023 breach through its vendor CLEAResult via the MOVEit Transfer zero-day vulnerability, which affected approximately 10,964 customers enrolled in solar incentive and electric vehicle programs. At least two law firms — Cole & Van Note and Shamis & Gentile P.A. — have announced class action investigations related to the confirmed April 2026 phishing breach; no filed lawsuit has been identified specifically tied to the October 2026 Redact claim.
Key Facts at a Glance
- Company or Organization: Eversource Energy
- Industry: Energy & Utilities (Electric Distribution, Electric Transmission, Natural Gas Distribution, Water Services)
- Location: Headquartered in Connecticut and Massachusetts; serves customers in Connecticut, Massachusetts, and New Hampshire
- Incident type: Unconfirmed ransomware/data extortion claim (Redact group)
- Date claim first observed: October 12th, 2026
- Prior breach: Yes — 2021 cloud misconfiguration (~11,000 customers); 2023 MOVEit/CLEAResult vendor breach (~10,964 customers); confirmed April 2026 phishing breach (3,049 individuals)
- Litigation status: Class action investigations announced by Cole & Van Note and Shamis & Gentile P.A. related to the April 2026 phishing breach; no filed lawsuit tied to the October 2026 Redact claim
- Source: Ransomware.live — Eversource Energy claim; Eversource Energy official statement (April 2026 phishing breach); UpGuard; SOCRadar — Redact Group Profile; ISSSource; BleepingComputer (2021 breach)
What Should You Do?
If you are an Eversource Energy customer and are concerned about either the unconfirmed October 2026 Redact claim or the confirmed April 2026 phishing breach, there are practical steps you can take now. If you received a notification letter from Eversource related to the April 2026 breach, the company offered 24 months of complimentary identity protection services through IDX — review your letter for enrollment instructions and any applicable deadline. Whether or not you received a letter, you should place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent unauthorized accounts from being opened in your name. Monitor your credit reports regularly; you can access free reports at AnnualCreditReport.com. Watch your financial account statements closely for any unauthorized transactions. If you suspect your information has already been misused, visit IdentityTheft.gov for step-by-step guidance on reporting and recovery.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
