NEW ORLEANS — The New Orleans City Council requested a management audit of Entergy New Orleans and an independent review of cybersecurity systems Tuesday in response to a WWL-TV investigation that found phone scammers appeared to have access to Entergy billing data.
City Council President Helena Moreno credited WWL-TV with a series of reports that showed evidence of a possible data breach. She noted the news reports showed copies of bills provided by two different Entergy customers, both of whom said the scammers called them and cited specific amounts they owed or previously owed.
Both customers, Terrell Perry and Drew Ward, provided recordings of the scam calls in which scammers pretending to represent Entergy informed them that their previous payments had not been received and failure to pay immediately would result in their power being shut off.
“He knew I had to pay a deposit,” Perry said of the scammer who started calling her in September 2020. “That’s the biggest thing because I literally had just called Entergy to connect the service and I hadn’t even received a bill yet. That’s what freaked me out.
“And I find it very, very hard to believe that if a scammer wasn't getting real time data that he would know I owed a deposit,” Perry said.
Ward said the scammer who called him in November cited specific amounts he tried to pay Entergy and had returned to him because of a real Entergy billing problem.
But Entergy Vice President and Chief Security Officer Chris Peters told the City Council committee there was no data breach found, either on Entergy’s end or with any of the third-party vendors who also have access to Entergy’s customer data.
“There is no indication that Entergy or vendor systems were divulged or were the source of the scammer’s information,” he said.
Entergy officials said they reached out to Perry and Ward after they appeared in the WWL-TV reports to assure them the scammers did not have accurate information from their accounts.
“We were firm with those two customers the scammers had the wrong information about their balances,” Peters told the committee.
But Ward said the last time he spoke to a real Entergy representative was in November, shortly after he reported the scam, and he said the official acknowledged then that the scammers had cited real amounts Ward had owed.
“I asked… ‘Could you have somebody on your end who is part of the scam?’” Ward recalled. “And her response was, ‘We don't think so. It's our concern as well, but we don't think that's the case. But we're going to be investigating.’”
Meanwhile, Perry said she hasn’t heard from Entergy representatives since she called them to report the scam in the fall. She praised Moreno for pressing the issue with Entergy’s leadership because she has heard from several friends who have also received the scam calls.
Perry says she’s worried about elderly people, including her 83-year-old mother, who could be intimidated by the aggressive scammers, especially ones who can refer to specific amounts owed.
Entergy’s vice president for Information Security, Ann Delenela, said she suspected customers, not the utility or its vendors, were the ones who were hacked.
But Ward said that doesn’t fit with a message that recently popped up on his iPad, saying his Entergy password had appeared in a data leak.
After hearing from the Entergy officials, Moreno ordered a full management audit of Entergy’s systems. She also asked the City Council’s utility advisers out of Colorado to perform a “sensitive data analysis” of Entergy’s third-party vendors’ systems.