The third-party vendor that provides and operates EPCOR USA’s customer telephone system has reported a ransomware attack. While there is no indication to date that customer data has been compromised, customer phone services are operating below normal capacity and bill payment by phone is currently unavailable.

EPCOR USA’s phone system vendor, Faneuil, Inc., notified EPCOR USA of a cyberattack on Faneuil’s telephone system Aug. 18. EPCOR USA immediately severed all connections between Faneuil and EPCOR USA’s customer account system. This disconnection has resulted in long wait times for U.S. customers calling for general customer support and the pay-by-phone option is currently unavailable. As well, some customer service agents may not have full access to customer accounts at this time.

A press release from EPCOR USA states the company has been communicating around the clock with Faneuil, Inc. to determine when the system will be restored to normal. The issue was initially expected to be resolved within a short period of time. However, as of Aug. 27, EPCOR USA has not reconnected to Faneuil and Faneuil continues its work to ensure that any connection to Faneuil’s system will be secure and protected. Until that time, EPCOR USA will continue to redirect calls coming in to its 1-800-383-0834 customer service number to a secondary phone system.

EPCOR Director of Public Affairs Rebecca Stenholm said they continue to work to rectify the situation.

“Hold times were significantly improved over the weekend and we have re-routed all call center agents so that they now have access to see the account management system and are able to provide better assistance when customers call,” Stenholm said Monday. “The outstanding item is the pay-by-phone option, which we hope to have resolved soon.”

EPCOR’s water, wastewater and natural gas services are not impacted in any way, in the U.S. or Canada. The vendor does not provide any Canadian customer services, so there are no impacts to Canadian customer data or service levels. Until further notice, the company is suspending all late fees and service disconnections for late payment in its U.S. service areas. Customers can still pay bills securely online through EPCOR’s customer account portal – it is completely separate and has not been impacted by the ransomware attack. EPCOR’s Customer Care team can still turn services on and off, take reports of maintenance issues, respond to emergencies, and answer general questions. Accounts scheduled to be paid through AutoPay between Aug. 21 and Aug. 26 were delayed several days to ensure customer protection.

Although there is no indication at this time that any personal customer data was breached, as an additional layer of security the company also recommends that EPCOR USA customers consider changing their passwords on their financial accounts and look over recent statements for any unauthorized activity.

EPCOR USA’s Director of Customer Operations Sarah Skaggs said, “We know that our phone system vendor’s ransomware incident is causing concern, frustration and inconvenience for our customers. We’re committed to protecting your data and providing updates as we receive more answers from the vendor.

“In the meantime, we’re taking all of the steps necessary to keep customer information secure and working with our vendor around the clock to restore customer phone services as quickly as possible to the level of quality and security our customers expect.”

EPCOR USA’s Customer Care phone line remains open at 1-800-383-0834 – press 3 or 4 to reach a live agent. Customers should expect potentially long wait times. Wait times may be longest between 8 a.m. and 5 p.m. The company encourages customers to reach out by email at mywater@epcor.com or myepcorgas@epcor.com, depending on what service they receive from EPCOR – or via social media: Facebook.com/EPCORUSA; Twitter.com/EPCORUSA.

Customers can find current updates and resources at epcor.com.