Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
PURA finds Connecticut gas companies' breach response reasonable but flags security gaps
Summary
PURA found that Connecticut Natural Gas and Southern Connecticut Gas responded reasonably to a phishing-related data breach by an Avangrid employee but identified areas for improvement in cybersecurity practices and referred follow-up to its 2026 emergency response plan review docket.
The Public Utilities Regulatory Authority adopted staff findings on March 25, 2026, that Connecticut Natural Gas (CNG) and Southern Connecticut Gas (SCG) acted reasonably in their cybersecurity program and response after an Avangrid employee fell for a phishing email that exposed customer account and billing-status information.
Authority staff member Trevor Row summarized the investigation in docket 25-04-23, filed by the Office of Consumer Counsel. Row said the authority reviewed the OCC petition, Avangrid's investigative report and interrogatory responses, and participants' briefs to assess compliance with General Statutes 36a-701b, the statute requiring certain actions following a computerized breach of personal information. "Although Avangrid acted reasonably...the authority identified certain areas for continuous attention and improvement in the company's cybersecurity program, data sharing and security practices, internal IT alerts, and language used to inform customers of data breaches," Row said.
PURA recommended further review in docket 26-02-03 (the 2026 review of emergency response plans) to evaluate adherence to standards such as those from the National Institute of Standards and Technology. A motion to adopt the staff recommendation was made and seconded; Chair Tom Wheel abstained from the vote due to prior participation, and the remaining commissioners voted 'Yes,' adopting the decision.
The order records no formal penalties in the transcript; instead, it documents staff findings that the utilities acted reasonably and requires ongoing review and attention to identified improvements. The transcript does not include the mover or seconder names for the motion to adopt.
