Estimated reading time: 9 minutes.
Key facts
- What happened: A plaintiff who says he works for Eversource filed a proposed class action on October 20, 2026, alleging the utility failed to protect personal information in a cyberattack on or around October 12, 2026.
- The case: Losch v. Eversource Energy Service Company, No. 1:26-cv-14752, in the U.S. District Court for the District of Massachusetts, assigned to Judge Richard G. Stearns.
- What the suit relies on: A listing by the Redact ransomware group, which posted Eversource Energy on its leak site on October 12, 2026 and claims to have taken 3.8 terabytes of data. The complaint makes its central breach allegations "upon information and belief."
- What Eversource has said: We found no Eversource statement confirming an October 2026 incident. The company did confirm a separate phishing incident in May 2026 involving about 3,049 people.
- Who the suit covers: A proposed nationwide class of everyone in the United States whose information was compromised in the alleged breach. The complaint estimates the number at "in the thousands."
- Status: Complaint stage. No court has ruled, no class has been certified, and there is no settlement or claim form.
In this article
- What the lawsuit alleges
- What the ransomware group claims
- What Eversource has confirmed
- Who filed the case and who is in the proposed class
- The legal claims and what the plaintiff wants
- Why lawsuits now follow leak-site posts
- Timeline
- Who may be affected and what you can do now
- What remains unresolved
- What happens next
- Frequently asked questions
What the lawsuit alleges
Eversource is a utility serving customers in Connecticut, Massachusetts and New Hampshire. The 38-page complaint describes it as New England's largest energy delivery company, with about 4.4 million residential and business electric, gas and water customers. Eversource's own May 2026 statement put the figure at more than 4.6 million.
The complaint alleges that on or around October 12, 2026, cybercriminals accessed Eversource's network and took sensitive data. It alleges that the plaintiff's personal information is now available on the dark web and that the attackers obtained what they need to commit identity theft against "thousands of individuals." Each of those core points is made upon information and belief.
The complaint argues that the breach was preventable. It says Eversource should have encrypted its files, limited access to sensitive data and followed federal guidance on ransomware prevention, and it contends that the breach itself shows those steps were not taken. It does not describe how the attackers got in, and it does not identify which kinds of personal information were in the data. It discusses the risks of stolen Social Security numbers in general terms without alleging that Eversource lost any.
What upon information and belief means Lawyers use this phrase for allegations they believe are true but cannot yet confirm from their own knowledge. It signals that the facts still need to be proven through evidence gathered in the case.
What the ransomware group claims
The complaint's only cited source for the breach date is a page on Ransomware.live, a site that tracks postings by ransomware and extortion groups. That page records Eversource Energy as a victim listed by a group called Redact on October 12, 2026, with a claim that 3.8 terabytes of data were taken.
Groups like Redact post company names on leak sites to pressure victims into paying. Their claims come from the attackers themselves. Almeida Law Group, a firm investigating the incident, notes that the Redact post described the victim as an energy distribution company with about $14 billion in annual revenue and that no independent source had confirmed the claim.
A leak-site post is not a confirmed breach The size of the alleged theft, its date and its contents all come from the group that says it carried out the attack. None of those details had been verified by Eversource, a regulator or an independent investigator when we reviewed the record.
What Eversource has confirmed
As of October 26, 2026, we found no public statement from Eversource about an October 2026 incident and no breach notice tied to it.
Eversource did confirm an earlier, separate incident. In a statement dated May 22, 2026, the company said it had found unauthorized activity involving employee credentials obtained through phishing and social engineering attacks, and that limited company data was accessed through the compromised accounts of two employees. Eversource said:
- The activity was identified and blocked, and it added security measures.
- There was no impact on electric, gas or water service, and no intrusion into customer information systems or other critical systems.
- The data accessed included personal information of about 3,049 former or current customers or household members.
- It arranged two years of complimentary credit monitoring and identity theft restoration services, and would notify affected people directly.
The Losch complaint does not mention the May incident, and nothing in the public record connects it to the October claim.
Who filed the case and who is in the proposed class
The plaintiff, Peter Losch, lives in Bethel Park, Pennsylvania. The complaint says he was an Eversource employee at all relevant times and had to provide his personal information as a condition of employment. It says he has spent time researching the breach and monitoring his financial accounts and credit, and that he has experienced stress and fear over the possible exposure.
He seeks to represent this proposed class: all persons residing in the United States whose private information was compromised in the data breach. Eversource and its affiliates, officers and directors, and the judges and court staff on the case are excluded.
The definition does not separate customers from employees. The complaint does not say whether any customer records were involved. The only person it identifies as affected is the employee plaintiff.
The case was filed by Casondra Turner of Milberg PLLC, with Jonathan Streisfeld of Kopelowitz Ostrow P.A. listed as counsel seeking admission for this case. The plaintiff demands a jury trial. Any matter the judge refers to a magistrate judge will go to Magistrate Judge Jessica D. Hedges.
The legal claims and what the plaintiff wants
The complaint brings four claims on behalf of the plaintiff and the proposed class:
- Negligence. Eversource allegedly failed to use reasonable care to protect the information it collected.
- Negligence per se. This claim says Eversource violated a legal standard, here the Federal Trade Commission Act's ban on unfair practices, which the complaint reads to require reasonable data security.
- Breach of implied contract. The plaintiff says people gave Eversource their information on the understanding it would be protected.
- Unjust enrichment. The plaintiff says Eversource benefited from the data without paying for adequate security.
The complaint asks for actual, statutory, punitive and nominal damages, restitution and disgorgement. It also asks for credit monitoring and identity theft insurance, and for court orders requiring Eversource to improve its data security and disclose what information was compromised.
Why lawsuits now follow leak-site posts
Data breach suits are often filed within days of a company's breach notice. In this case, the suit came before any notice at all. A similar suit was filed against Parker-Hannifin in Ohio on October 19, 2026 after Redact claimed an attack there, according to OpenClassActions.
Suits filed this early often face a key hurdle. To stay in federal court, a plaintiff must show a concrete injury, and defendants often argue that an unconfirmed incident with no proof of misuse falls short. How the court treats that question here will depend on what the evidence shows about the alleged breach.
No claim to file There is no settlement, fund or claim form in this case. Anyone asking you for personal or payment information to join an Eversource breach claim is not acting for the court.
Timeline
| Date | Event |
|---|---|
| May 22, 2026 | Eversource announces a phishing incident affecting about 3,049 people |
| October 12, 2026 | Redact lists Eversource Energy on its leak site, claiming 3.8 TB of data |
| October 20, 2026 | Losch files a proposed class action in federal court in Boston; Judge Stearns is assigned |
| October 26, 2026 | No Eversource confirmation of an October incident found |
Who may be affected and what you can do now
The proposed class covers anyone in the United States whose information was compromised in the alleged October breach. Because Eversource has not confirmed an incident, no one yet knows who, if anyone, falls in that group. The only person identified is an employee.
Steps that make sense while the facts are unknown:
- Watch your mail and email for any notice from Eversource. A real breach notice would explain what was involved and what help is offered.
- Be cautious with emails, texts and calls that mention the breach and ask for account details or payment.
- If you received a notice about the May 2026 phishing incident, enroll in the credit monitoring it describes.
- Consider placing a free fraud alert or credit freeze with the three credit bureaus if you are concerned.
For cases with open claims or recruiting now, see our list of class action cases you can join.
What remains unresolved
- Whether a breach happened. Eversource has not confirmed an October 2026 incident.
- What data is involved. The complaint does not identify data types, and the 3.8 terabyte figure comes from the attackers.
- Who is affected. It is unknown whether customers, employees or both could be involved, and how many.
- Eversource's response in court. The company had not responded to the complaint when we reviewed the docket.
- Other suits. Additional cases over the same alleged incident could be filed and combined with this one.
This article is for information only and is not legal advice. The complaint's allegations have not been proven.
What happens next
The docket shows a summons was issued on October 20, 2026. After service, Eversource will have time to answer or file a motion to dismiss. If Eversource confirms an incident, state breach notices or a federal securities filing would likely give the first official account of its scope. We will update this story when that happens.
Frequently asked questions
Did Eversource have a data breach in October 2026?
Eversource had not confirmed one when we reviewed the record on October 26, 2026. The claim comes from the Redact ransomware group's leak site and from a class action complaint that makes its breach allegations on information and belief.
What is the Eversource class action lawsuit about?
Losch v. Eversource Energy Service Company alleges Eversource failed to protect personal information stolen in a cyberattack around October 12, 2026. It seeks damages, credit monitoring and better data security.
Is the lawsuit about the May 2026 Eversource phishing incident?
No. The lawsuit concerns the alleged October incident. The May incident, which Eversource confirmed, involved about 3,049 people and is not mentioned in the complaint.
What information was taken?
The complaint does not say. Eversource has not described any October incident, and the Redact group's 3.8 terabyte claim has not been verified.
Is there an Eversource settlement or claim form?
No. The case was filed on October 20, 2026 and is at the complaint stage. There is no settlement, claim form or deadline.
Who is the plaintiff?
Peter Losch, a Pennsylvania resident who says he was an Eversource employee. He is represented by Milberg PLLC and Kopelowitz Ostrow P.A.
