Unverified claim: on 12 October 2026, the leak tracker Ransomware.live indexed Eversource Energy as a victim of the extortion brand Redact. The public victim card shows discovered 12 October 2026 at 03:23 UTC, an estimated attack date of 12 October 2026, and an actor-side field alleging 3.8 TB of data exfiltrated. Trade summaries reposting the tracker (for example QPulse and Today In Cyber on 12 October 2026) repeat the volume figure as part of the listing — not as utility-confirmed fact. As of BreachHistory indexing, Eversource had not published a statementunverified extortion claim, not verified exfiltration. This is not a confirmed Eversource data breach.
What the Ransomware.live Eversource card shows
Ransomware.live’s victim page for Eversource tags the organization in energy distribution, includes a revenue estimate in the description block, and displays the 3.8 TB exfiltration label Redact attached to the listing. The mirror also shows enrichment such as historical infostealer statistics and DNS/MX observations (for example Proofpoint-hosted mail exchangers). Those OSINT panels describe the internet footprint of eversource.com; they do not prove Redact stole 3.8 TB from Eversource on 12 October 2026.
What the open tracker mirror does not provide, at indexing time, is a verified file tree, downloadable samples, or Eversource attestation of categories (customer billing, operational technology, employee HR, etc.). QPulse’s 12 October 2026 writeup explicitly notes the source lacks attack vector, vulnerability class, and compromised system detail. That thinness is typical early in leak-site cycles — and it is why catalogs must label the row unverified.
BreachHistory stores recordsAffected: 0 for people counts because terabytes are not people, and because no company/regulator census exists. The 3.8 TB string belongs in prose as an actor claim only.
Do not confuse this with Eversource’s May 2026 phishing disclosure
Eversource did publish a verified corporate news statement on 22 May 2026 about unauthorized activity involving employee credentials obtained through phishing and social engineering. That incident involved limited access via two compromised employee accounts, no impact to electric, gas, or water service, and no intrusion into customer information systems or critical operational systems, per the company. Eversource said approximately 3,049 current or former customers or household members were associated with some accessed company data, with direct notification and credit monitoring offered.
The October 2026 Redact listing is a separate thread: a criminal group’s public victim tile with a terabyte claim. BreachHistory does not merge the May confirmed event into this October claim, and readers should not assume the May investigation “predicts” Redact’s 3.8 TB allegation. If Eversource later connects the dots, update the catalog — until then, keep two timelines.
Timeline (public, October 2026 claim)
- 12 October 2026 (estimated attack date field) — Ransomware.live metadata on the Redact / Eversource victim entry (actor-side estimate).
- 12 October 2026, 03:23 UTC — Discovery timestamp on Ransomware.live for the listing.
- 12 October 2026 — Third-party newsletters summarize the claim and the 3.8 TB exfil label sourced to Ransomware.live.
- 12 October 2026 (indexing) — BreachHistory records unverified status; companyConfirmed false for this leak-site row.
Critical infrastructure context — without inventing grid impact
Eversource is a major U.S. utility serving millions of electric and gas customers across New England. That makes the headline sensitive: readers worry about blackouts, SCADA compromise, and billing system leaks in the same breath. The Redact listing itself, as indexed, does not assert service disruptions, feeder outages, or OT network access. QPulse discusses operational disruption as a risk theme for utilities hit by ransomware — not as a confirmed fact for this case.
Responsible reporting separates energy sector targeting from confirmed operational technology compromise. Until Eversource or regulators speak, do not claim the 3.8 TB trove mapped to GIS, EMS, or customer CIS databases.
Who Redact are — campaign context only
Redact appears on Ransomware.live as an active leak-site brand naming victims across sectors. Today In Cyber’s 12 October 2026 note describes the Eversource entry as part of ongoing critical-infrastructure targeting patterns. That is analyst commentary on sector risk, not forensic proof against Eversource’s environment. Group reputation does not substitute for victim confirmation.
What 3.8 TB might imply — and what it does not prove
Extortion sites sometimes cite large volumes to intimidate: backups, file shares, email PSTs, engineering drawings, or mixed junk folders. Terabyte counts are easy to inflate with duplicates and virtual machine images. Without samples or a company field list, 3.8 TB exfiltrated is a pressure number on a tile — not a validated DLP alert.
Hypothetical categories in utility breaches (when later confirmed elsewhere) often include customer billing contacts, outage notification preferences, contractor safety records, and employee HR files. None of those categories are attested for this Redact claim today.
What is not established
- No Eversource confirmation of Redact intrusion or data theft on 12 October 2026 in cited sources.
- No customer recordsAffected census tied to this listing.
- No verified OT / grid impact — do not spread outage rumors from leak-site screenshots alone.
- No independent file publication verified by trade press with substance in the sources BreachHistory indexes for this row.
Who should pay attention
Eversource residential and business customers. Utility brands attract bill-pay phishing whether or not data leaked. A rumored “Eversource breach 2026” headline increases fake past-due texts citing real addresses scraped from older, unrelated leaks.
Former customers in the May 2026 notification cohort. You already received company attestation for that separate event. The October Redact tile does not automatically expand that cohort — wait for new official mail.
Municipal partners and contractors. Vendors with eversource.com inboxes should watch for invoice fraud and credential phishing referencing Redact.
Regional SOCs and ISACs. Share the IOC timeline (listing UTC) without treating terabyte marketing as exfil confirmation.
Phishing scenarios after utility leak claims
- Fake shutoff threats demanding instant payment via crypto or Zelle.
- “Your account was in the 3.8 TB leak — verify SSN” portals harvesting full identifiers Eversource’s May notice said were out of scope for that earlier event.
- Credit monitoring impersonators asking for payment to “enroll” — real programs follow official letters.
- Contractor safety portal clones targeting field vendors after infrastructure news cycles.
Navigate to eversource.com by typing the address or using the official app. Ignore SMS short links citing Redact.
What Eversource and regulators have said (October claim)
For the 12 October 2026 Redact listing, BreachHistory found no matching Eversource newsroom post, SEC exhibit, or state AG PDF in the sources cited here. The May 22, 2026 phishing statement remains the attested company narrative for a different incident with a defined ~3,049-person notification scope — cite it only in that context.
Absence of an October statement is not proof the leak claim is false; it means consumers lack victim-confirmed detail. Regulators may lag even when companies investigate.
Action items for Eversource customers
- Treat the 3.8 TB figure as an unverified actor claim until Eversource confirms categories and counts.
- Do not share leak-site gallery screenshots as proof your account leaked.
- Enable MFA on your Eversource online profile if available; rotate reused passwords.
- Report suspicious bill texts to Eversource through official contact channels.
- If you already enrolled in monitoring from the May 2026 notice, follow that letter’s terms — do not pay strangers offering “upgrade” monitoring after Redact headlines.
- Businesses should verify wire and ACH changes out-of-band — utility vendor fraud spikes after sector news.
- Bookmark updates: Eversource Redact claim.
- Watch the canonical catalog path /eversource-energy/eversource-redact2026 rather than rumor forums.
How defenders should triage
Use the four-question rubric: unambiguous naming (yes on Ransomware.live), published samples (not attested in open sources cited), company/regulator speech (none for October claim), independent corroboration with substance (tracker reposts only). Outcome: monitor and hunt internally if you are Eversource; consumer hygiene if you are a customer — not panic about grid collapse based on a TB label.
Utilities should ensure DLP and egress alerts cover unusual bulk transfers, verify backup integrity, and rehearse comms plans if a leak post escalates to confirmed exfiltration.
Energy sector ransomware patterns (grounded)
Confirmed utility customer-data incidents elsewhere in 2026 often involve portal or billing-facing systems while delivery operations continue — see verified portal breaches cataloged on BreachHistory. Leak-site claims against holding companies sometimes aim at IT and back-office shares rather than substation controls. That historical pattern is why CTI and QPulse discuss critical infrastructure — it is not proof Redact reached OT here.
Reading Ransomware.live fields carefully
The discovered timestamp is when monitors saw the victim name published — not necessarily when intrusion began. The est. attack date field can equal discovery when actors post and claim simultaneously. The data exfiltrated line reflects what Redact typed into its template, not a third-party measurement.
DNS and MX records on the victim page illustrate mail routing (Proofpoint in the indexed snapshot). They do not validate breach content.
Media, politicians, and rumor control
Local news may pick up “Eversource ransomware 3.8 TB” from trackers within hours. Editors should attribute the terabyte figure to Redact’s listing via Ransomware.live and note Eversource’s lack of confirmation at publication time. Linking to the May 2026 phishing notice without clarifying it is a different event will confuse readers about who was notified and why.
Vendor risk questionnaires
Enterprises asking whether Eversource “was breached on October 12, 2026” should answer: Redact listed the utility on a leak site with a 3.8 TB exfil claim; Eversource has not confirmed that claim in the sources BreachHistory cites; recordsAffected for people remains unset. Distinguish confirmed May 2026 credential phishing impact (~3,049 individuals per company statement) from October actor marketing.
Legal and notification outlook
If investigation later confirms personal data theft, state breach-notification laws may require mailings — but timing and scope depend on facts not present in the leak tile. Speculating about mandatory notices today is premature. Lawyers should watch for company statements, not countdown timers on criminal blogs.
Threat intelligence handling
Archive the Ransomware.live victim URL, UTC discovery, and group attribution. Do not download or republish alleged samples if they appear later. Share defensive guidance with customer contact centers so agents recognize fraud spikes tied to headlines.
Information Sharing and Analysis Centers (ISACs) may circulate tracker IOCs; mark them unverified extortion claims to avoid false-positive OT incident declarations.
Customer service and call-center scripts
Prepare agents to say: “We are aware of online reports; please refer to official Eversource communications for confirmed impacts.” Avoid confirming Redact’s terabyte figure on recorded calls unless leadership publishes it.
Comparing to verified utility breaches
Verified utility rows on BreachHistory include company quotes, field lists, and often counts. This Redact row has a name, UTC timestamps, and an actor TB label. Searchers comparing “Eversource data breach 2026” results should see why one page discusses May notifications with ~3,049 people and another discusses an October CLAIM — UNVERIFIED listing.
Extended FAQ
Will my power go out? No source cited here confirms operational impact from the Redact claim. May 2026 company language explicitly denied service impact for the phishing incident — a different event.
Is 3.8 TB definitely customer PII? Unknown. Volume alone does not reveal content.
Should I freeze credit? Consider it if a future confirmed notice lists SSNs or financial fields — not based on the leak tile alone.
Was I in the May breach? Only if you received Eversource’s attested notification about that event.
Canonical record and sources
Catalog entry: /eversource-energy/eversource-redact2026. Primary reference: Ransomware.live victim indexing for Eversource Energy / Redact (discovered 12 Oct 2026, 03:23 UTC; actor claim 3.8 TB data exfiltrated). Secondary summaries: QPulse and Today In Cyber (12 Oct 2026) reposting tracker metadata — useful for timing, not confirmation. Eversource’s May 22, 2026 corporate news item documents a separate verified phishing/credential event. BreachHistory does not use Breachsense. Update this Eversource breach 2026 writeup when the utility or regulators confirm or rebut the Redact claim.
Operational technology reassurance — with limits
Customers understandably fear cascade failures when “utility” and “ransomware” share a headline. Industrial control systems are often network-segmented from corporate IT — but segmentation is not a promise in either direction for this unverified claim. Eversource has not stated OT impact for October 2026. Do not circulate unverified SCADA compromise rumors.
Red team / tabletop prompt
Security leaders can tabletop: “Redact names us at 03:23 UTC with a TB claim; no samples yet.” Test executive comms, legal hold, customer web updates, and coordination with state utility commissions — without assuming the exercise equals reality.
New England customer geography
Eversource serves Connecticut, Massachusetts, and New Hampshire under one corporate umbrella, which means breach-search traffic spikes across three state AG ecosystems simultaneously when a leak tile drops. None of those offices had published a sample notification tied to this Redact listing in the sources BreachHistory indexed on 12 October 2026. Customers in each state should still use state-specific official URLs for account management rather than search-engine ads triggered by “Eversource hacked” keywords.
Closing boundary statement
Redact’s listing of Eversource Energy on 12 October 2026 with a claimed 3.8 TB exfiltration is a high-signal extortion marketing event for defenders and a phishing accelerant for criminals. It is not, by itself, proof of a confirmed Eversource data breach, customer notification obligation, or grid emergency. Hold the line between the verified May 2026 credential incident and this unverified October leak-site row until primary sources say otherwise.