Unsecured cloud storage led to data exposure at New England energy company

New England's largest energy provider, Eversource, set cloud storage to open access

Three locks in binary code on a screen

Eversource, New England’s largest energy supplier, exposed thousands of customers’ information following a cloud security misconfiguration.

The company is the largest utility in the region and provides electricity and gas to 4.3 million customers in Connecticut, Massachusetts, and New Hampshire.

According to a document released by cyber security firm Cyberscout, a March 16 security review revealed that one of its cloud data storage folders had been misconfigured and set to open access rather than restricted access. The files were created in August 2019. 

The data exposure affected approximately 11,000 customers, and the company has notified them all.

The folder contained several files with the personal information of some Eversource eastern Massachusetts customers, including customers’ names, addresses, phone numbers, Social Security numbers, Eversource account numbers, and Massachusetts service addresses. No banking or financial information was involved.

The files were secured the very same day they were discovered, according to the company. The company’s security team said they had no indication that the personal information has been “accessed, acquired or misused by any external party.”

The company’s security team said that the exposure was unintentional and not the result of an attack or breach of Eversource systems.

Camille Charaudeau, VP of product strategy at digital risk protection company CybelAngel, told ITPro that this breach is further proof that addressing data breaches outside the corporate firewall is vital to managing your third-party risk.

“As more organizations turn to cloud providers for everything from infrastructure to apps to support employees, save money, and enable digital transformation, they are expanding their attack surface exponentially,” he said.

“Organizations must constantly scan for leaked documents outside the enterprise perimeter, including connected storage, open databases, cloud applications, and the Dark Web to detect and resolve external risks quickly, before they are exploited.”

Felix Rosbach, product manager at comforte AG, told ITPro that data breaches from cloud computing often happen because sensitive data is stored and processed in clear text form. 

“While cloud service providers offer data security capabilities, the particular business is still the responsible caretaker. The increased attack surface of cloud environments makes for a potentially weak overall security posture,” he said. 

“With a hybrid and multi-cloud strategy data becomes dispersed across multiple clouds as well as their own data centers. With that data security becomes even more difficult to manage. Combined with a modern DevOps culture, misconfigurations and overlooking general security requirements are becoming commonplace.”

Featured Resources

How to be an MSP: Seven steps to success

Building your business from the ground up

Download now

The smart buyer’s guide to flash

Find out whether flash storage is right for your business

Download now

How MSPs build outperforming sales teams

The definitive guide to sales

Download now

The business guide to ransomware

Everything you need to know to keep your company afloat

Download now

Recommended

GitHub now supports security keys in a move away from passwords
Security

GitHub now supports security keys in a move away from passwords

12 May 2021
Cyber attacks on manufacturing up 300% in a year
Security

Cyber attacks on manufacturing up 300% in a year

11 May 2021
US fuel pipeline hackers reveal their motive
ransomware

US fuel pipeline hackers reveal their motive

11 May 2021
Trend Micro and Snyk team up to combat open source flaws
vulnerability

Trend Micro and Snyk team up to combat open source flaws

10 May 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021