People in the U.S. whose personal information was compromised in an alleged October 2026 cyberattack on Eversource may be covered by a proposed class action alleging Eversource Energy Service Company failed to protect that information. Eversource has not confirmed an October breach, no class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Eversource Energy Service Company has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
A proposed class action filed October 20, 2026 accuses Eversource Energy Service Company of failing to protect personal information in a cyberattack the complaint says happened on or around October 12, 2026. The case is Losch v. Eversource Energy Service Company, No. 1:26-cv-14752, in the U.S. District Court for the District of Massachusetts.Eversource has not confirmed that an October attack happened. The suit rests on two things: a posting by the Redact ransomware group, which added “Eversource Energy” to its leak site on October 12 and claims to have taken 3.8 terabytes of data, and allegations the complaint makes “upon information and belief,” the phrase lawyers use for claims they have not yet been able to confirm firsthand. A ransomware group’s claim is not proof of what, if anything, was taken. As of October 25, 2026, no Eversource statement about an October incident had been found, and the company had not filed an SEC Form 8-K reporting a cybersecurity incident.
The case is at the complaint stage. No court has ruled on any of the allegations, no class has been certified, and there is no settlement or claim form.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What the Ransomware Group Claims
Ransomware groups post the names of organizations they say they have attacked on leak sites, usually to pressure the victim into paying. Ransomware.live, a site that tracks those postings, recorded “Eversource Energy” as a Redact listing discovered on October 12, 2026, with an estimated attack date the same day and 3.8 TB of data said to have been exfiltrated. The complaint cites that record as its source for the breach date.Those details come from the attackers. Eversource has not said whether its systems were accessed in October, what data might be involved or whose information it would concern, and none of the group’s claims has been independently verified.
What the Lawsuit Alleges
The complaint describes Eversource as New England’s largest energy delivery company, serving about 4.4 million residential and business electric, gas and water customers in Connecticut, Massachusetts and New Hampshire. (Eversource’s own May 2026 statement put the figure at more than 4.6 million.) It alleges that:- Cybercriminals got into Eversource’s network on or around October 12, 2026 and took sensitive data, an allegation made on information and belief
- Eversource did not use reasonable safeguards, such as encryption, limits on access to sensitive files, multi-factor authentication and monitoring for large data transfers
- The named plaintiff’s information is available on the dark web, also alleged on information and belief
- People whose data was involved face a continuing risk of identity theft and fraud and have spent time responding to the breach
The complaint does not identify what kinds of information were in the files. It discusses the risks of exposed Social Security numbers in general terms, but it does not allege that any particular data type was taken from Eversource. One count also says Eversource waited about ten months after detecting the breach to disclose it, which does not match the complaint’s own October 12 date; Eversource has not announced an October incident at all.
The named plaintiff, a Pennsylvania resident, says he was an Eversource employee and had to provide his personal information as a condition of employment. The complaint was filed by Milberg PLLC, with Kopelowitz Ostrow P.A. also listed as counsel.
Who Is in the Proposed Class?
The complaint proposes one nationwide class: all persons residing in the United States whose private information was compromised in the alleged October 2026 breach. Eversource, its affiliates, officers and directors, and the judges and court staff assigned to the case are excluded.The definition does not distinguish between customers and employees, and the complaint does not say whether customer records were involved. The only person it identifies as affected is the named plaintiff, who says he was an Eversource employee. It estimates the number of people affected at “in the thousands,” again on information and belief. A class definition in a complaint is a proposal; a court would have to certify a class before anyone is formally part of the case.
Legal Claims and What the Lawsuit Seeks
The complaint brings four claims: negligence, negligence per se (based on the Federal Trade Commission Act’s ban on unfair practices), breach of implied contract, and unjust enrichment. It asks for actual, statutory, punitive and nominal damages, restitution, and an order requiring Eversource to improve its data security, disclose what information was compromised, and provide credit monitoring. The plaintiff also demands a jury trial. These are requests; no court has awarded anything.A Separate Incident Eversource Did Confirm in May 2026
Eversource has publicly acknowledged an earlier, unrelated incident. In a May 22, 2026 statement, the company said it had found unauthorized activity involving employee login credentials obtained through phishing and social engineering attacks, and that the attackers were able to access limited company data through two employees’ accounts.According to that statement, the data accessed included personal information of about 3,049 former or current customers or household members. Eversource said there was no impact on electric, gas or water service and no intrusion into its customer information systems, that it was sending direct notice to the people affected, and that it was offering them two years of complimentary credit monitoring and identity theft restoration services.
The October 2026 lawsuit is not about the May incident. The complaint does not mention it, and no connection between the two has been shown.
What Is Still Unknown
Nearly everything about the October event remains unconfirmed: whether Eversource’s systems were breached, what was taken, how many people it concerns, and whether customers, employees or both are involved. The complaint relies on the leak-site listing for its date and does not cite a breach notice, a regulator filing or a company statement. If Eversource confirms an incident, state data breach notices and any SEC filing would be the first public record of its scope.Several other companies sued this month after ransomware or extortion groups named them. A Parker-Hannifin suit followed a Redact claim, and DexCom faces suits over data an extortion group says it took. Another utility, Southern Company, was sued over a 2026 customer-portal breach.
What Happens Next
Eversource has not yet responded to the complaint in court. Data breach defendants commonly answer with a motion to dismiss. Other suits over the same alleged incident could be filed and combined with this one.There is nothing to file in the lawsuit now. If the case ever settles, people covered by the settlement would normally receive a court-approved notice explaining who qualifies and how to file a claim.
Questions
Did Eversource have a data breach in October 2026?
Eversource had not confirmed one as of October 25, 2026. The claim comes from the Redact ransomware group, which listed Eversource Energy on its leak site on October 12, 2026 and says it took 3.8 TB of data, and from a class action complaint that alleges the breach on information and belief. No Eversource statement about an October incident and no SEC Form 8-K reporting a cybersecurity incident had been found as of that date.
Is the Eversource lawsuit about the May 2026 phishing incident?
The lawsuit concerns a different, alleged incident on or around October 12, 2026. In May 2026, Eversource separately announced that phishing and social engineering attacks gave someone access to two employee accounts and to personal information of about 3,049 former or current customers or household members. The October 2026 complaint does not mention the May incident.
Who is included in the proposed Eversource class?
The complaint proposes a class of all persons residing in the United States whose private information was compromised in the alleged October 2026 breach, excluding Eversource, its affiliates, officers and directors, and the judges and court staff on the case. The named plaintiff says he provided his information as a condition of working for Eversource. The complaint does not say whether customer records, employee records or both were involved, and a court has not certified any class.
What information does the Eversource lawsuit say was taken?
The complaint does not identify specific types of information. It refers generally to personally identifiable information and discusses the risks of exposed Social Security numbers, without alleging that any particular data type was in the files. The only volume figure is the Redact group’s own claim of 3.8 TB, which has not been verified. The complaint estimates, on information and belief, that the number of people affected is in the thousands.
Is there an Eversource settlement or claim form?
There is no settlement, no claim form and no deadline. The case was filed October 20, 2026 and is at the complaint stage. If the case were to settle, a court-approved notice would explain who qualifies and how to file a claim.
Sources
• Class Action Complaint, Losch v. Eversource Energy Service Company, No. 1:26-cv-14752 (D. Mass., filed October 20, 2026): complaint (PDF) and docket.• Ransomware.live: Eversource Energy listing, Redact group (the attackers’ claim, as cited in the complaint).
• Eversource: Information on phishing and social engineering attacks (May 22, 2026).
• U.S. Securities and Exchange Commission: Eversource Energy Form 8-K filings (checked October 25, 2026).
