After an investigation that took the better part of two months, Central Hudson Gas & Electric Co. said it can't rule out whether hackers stole customer's banking information and implored customers to monitor their accounts.
The security breach was discovered Feb. 19 by an information technology staffer at the company who realized the servers had been compromised during the long Presidents Day holiday weekend.
On Tuesday, the company said that its servers were infiltrated by malware at least six months before the discovery in February. That malware was on the servers "during or prior to September 2012, but likely lay dormant until earlier this year," Central Hudson said in a statement.
The security breach compromised the personal and banking information of as many as 110,000 Central Hudson customers, the company said in February. That's about a third of the customers who buy power from the utility, which primarily serves Dutchess and Ulster counties.
Central Hudson enlisted the help of law enforcement and forensic computer experts, and the company said Tuesday that although the customer information was compromised, it cannot say for sure whether that data were transferred to the person or people who wrote the virus.
"Despite an exhaustive review, these cybersecurity forensic experts could not confirm if any private banking information for any of our customers was transferred," James P. Laurito, Central Hudson's president, wrote in a statement Tuesday. "They also report that it is likely that it may never be possible to document if information was transferred."
Although Laurito said Central Hudson was adding "new safeguards and procedures to further bolster our cybersecurity systems," he asked customers to register for credit monitoring services provided by the company. In February, Central Hudson sent notifications about the security breach to its customers and offered to pay for a year of credit monitoring.
Those customers have to register for the service by June 30. The monitoring service will retroactively examine customer accounts going back to Feb. 15 and "will cover all verifiable claims, providing that customers enroll and file fraud complaints promptly."
Customers with questions can call Central Hudson at 800-527-2714.