Eversource, New England’s largest energy supplier, exposed thousands of customers’ information following a cloud security misconfiguration.
The company is the largest utility in the region and provides electricity and gas to 4.3 million customers in Connecticut, Massachusetts, and New Hampshire.
According to a document released by cyber security firm Cyberscout, a March 16 security review revealed that one of its cloud data storage folders had been misconfigured and set to open access rather than restricted access. The files were created in August 2019.
The data exposure affected approximately 11,000 customers, and the company has notified them all.
The folder contained several files with the personal information of some Eversource eastern Massachusetts customers, including customers’ names, addresses, phone numbers, Social Security numbers, Eversource account numbers, and Massachusetts service addresses. No banking or financial information was involved.
The files were secured the very same day they were discovered, according to the company. The company’s security team said they had no indication that the personal information has been “accessed, acquired or misused by any external party.”
The company’s security team said that the exposure was unintentional and not the result of an attack or breach of Eversource systems.
Camille Charaudeau, VP of product strategy at digital risk protection company CybelAngel, told ITPro that this breach is further proof that addressing data breaches outside the corporate firewall is vital to managing your third-party risk.
“As more organizations turn to cloud providers for everything from infrastructure to apps to support employees, save money, and enable digital transformation, they are expanding their attack surface exponentially,” he said.
“Organizations must constantly scan for leaked documents outside the enterprise perimeter, including connected storage, open databases, cloud applications, and the Dark Web to detect and resolve external risks quickly, before they are exploited.”
Felix Rosbach, product manager at comforte AG, told ITPro that data breaches from cloud computing often happen because sensitive data is stored and processed in clear text form.
“While cloud service providers offer data security capabilities, the particular business is still the responsible caretaker. The increased attack surface of cloud environments makes for a potentially weak overall security posture,” he said.
“With a hybrid and multi-cloud strategy data becomes dispersed across multiple clouds as well as their own data centers. With that data security becomes even more difficult to manage. Combined with a modern DevOps culture, misconfigurations and overlooking general security requirements are becoming commonplace.”
-
M&S suspends online sales as 'cyber incident' continuesNews Marks & Spencer (M&S) has informed customers that all online and app sales have been suspended as the high street retailer battles a ‘cyber incident’.
-
Manners cost nothing, unless you’re using ChatGPTOpinion Polite users are costing OpenAI millions of dollars each year – but Ps and Qs are a small dent in what ChatGPT could cost the planet
-
Capita tells pension provider to 'assume' nearly 500,000 customers' data stolenCapita told the pension provider to “work on the assumption” that data had been stolen
-
Gumtree site code made personal data of users and sellers publicly accessibleNews Anyone could scan the website's HTML code to reveal personal information belonging to users of the popular second-hand classified adverts website
-
Pizza chain exposed 100,000 employees' Social Security numbersNews Former and current staff at California Pizza Kitchen potentially burned by hackers
-
83% of critical infrastructure companies have experienced breaches in the last three yearsNews Survey finds security practices are weak if not non-existent in critical firms
-
Identity Automation launches credential breach monitoring serviceNews New monitoring solution adds to the firm’s flagship RapidIdentity platform
-
Neiman Marcus data breach hits 4.6 million customersNews The breach took place last year, but details have only now come to light
-
Indiana notifies 750,000 after COVID-19 tracing data accessedNews The state is following up to ensure no information was transferred to bad actors
-
Pearson fined $1 million for downplaying severity of 2018 breachNews The SEC found the London-based firm made “misleading statements and omissions” about the intrusion
