NEW ORLEANS — Utility regulators on the New Orleans City Council want to know if Entergy New Orleans can ensure the security of customers’ data in response to a series of WWL-TV reports last week.
City Council President Helena Moreno, who is also the chairwoman of the council’s Utility Committee, is calling on Entergy to report about the security of billing data at a public hearing next week. She said she watched the WWL-TV investigation and was disturbed to learn that scammers pretending to be Entergy bill collectors appeared to know specific information about customers’ Entergy accounts.
She sent Entergy New Orleans CEO David Ellis a letter encouraging the company to review its data security operations and those of third-party vendors. The letter also invites Entergy representatives to discuss their findings at the next Utility Committee meeting, March 16.
“We'd heard about these potential scams, but we just thought it was, hey, someone's calling pretending to be Entergy or even the Sewerage & Water Board and saying you owe us money,” Moreno said. “But once we watched (WWL-TV’s) stories about the specificity of people's bills, that was when it became alarming and concerning.”
The station highlighted two Entergy customers who recorded phone calls with scammers purporting to be Entergy bill collectors. In both cases, the callers demanded immediate payment and threatened to cut off their electricity if payment wasn’t received in 45 minutes.
Terrell Perry, a Gentilly rental property owner, and Drew Ward, a Riverbend resident, separately told WWL-TV they spoke to scammers in the fall who were able to refer to exact amounts they owed at the time or had previously paid to Entergy.
“They had my data up to that day, so that what they had matched exactly what I had, to the minute,” said Ward, referring to his real Entergy bill that he pulled up online while speaking with the scammers on the phone. “So, that tells me that they were actively able to see everything.”
An Entergy spokeswoman told WWL-TV last week that it had investigated numerous scam reports by customers and “no evidence exists that customer information has been compromised.”
But Moreno said the news reports strongly suggest hackers have been able to access Entergy or one of its contractors’ computer systems.
“Maybe Entergy is right,” Moreno said. “Maybe they see nothing that's on their specific end right now or that their systems are secure. But there has been a breach somewhere along the way. So, who else received the data? Who did they send the data to? … Those are the questions that we need to answer.”
Moreno said the council has broad power to require Entergy to audit its data security and rectify any issues. The regulatory body has been getting tougher with Entergy in recent years. In 2019, it fined the utility for using paid actors to advocate for a new power plant in New Orleans East.
And just last week, the council joined other regulators from Arkansas and Louisiana in a $1.1 billion complaint against Entergy’s parent company. Their complaint to the Federal Energy Regulatory Commission demands refunds for customers who had to foot the bill for $800 million in repairs at Entergy’s Grand Gulf Nuclear Station in Mississippi and another $361 million to purchase power elsewhere when the nuclear plant suffered outages.
Ward said he thinks Entergy should shut down its online billing operations while trying to pinpoint the source of any data breach. Moreno said the council isn’t ready to impose that on Entergy, at least not yet.
“That certainly could be part of the solution down the road if it determined that this is something that is urgent and necessary,” Moreno said. “But first, we need to get to the bottom as to who was hacked. And then, based on that, let's move forward with whatever needs to be done to protect people's information.”
Entergy New Orleans declined to provide any specific comment on Moreno’s letter, instead standing by its previous statements that it had found no evidence that customer data had been compromised “at the present time.”