New York utilities disclose third-party unauthorized access to customer data

Two New York power companies, which have 1.8 million customers, have disclosed that customers' personal information, including social security numbers, dates of birth, and financial account data, may have been compromised by third-party unauthorized access.

The companies – New York State Electric & Gas and Rochester Gas and Electric, both subsidiaries of Iberdrola USA – sent letters this week to customers warning them of a possible data breach involving an employee at a third-party contractor who allowed unauthorized access to customer information systems. Both companies have a combined 1.8 million electricity and natural gas customers in New York.

The companies stressed in a news release that they have no evidence that the data were misused or that there was malicious intent on the part of the employee. They have informed law enforcement, hired computer forensics experts to investigate the incident, and are offering credit monitoring services to customers.