Halifax Water says ignored warning email delayed response to portal breach

Halifax Water says an outside party accessed information from 16 customer accounts through a vulnerability in its Customer Connect portal, and acknowledges that a February email warning about the flaw was wrongly dismissed as spam.

The number of affected accounts is small, but the utility's own timeline, published Aug. 13 and revised Aug. 17, shows two common failures: a vendor update that undid a security fix, and an external warning that never reached the security team.

What happened

According to Halifax Water's update, the portal runs on a third-party platform supplied by Avertra. The utility's own monitoring found a vulnerability in November 2025, and Avertra applied a patch. A vendor software update in January 2026 made that patch ineffective and re-exposed the flaw.

In February, an unknown third party emailed customer service about the vulnerability, and the message was treated as spam. When the same party followed up with customer care in March, the message reached the help desk and was escalated to the cybersecurity team. The utility took the portal offline, hired an independent firm and notified authorities.

The forensic investigation was substantially complete in April, the extent was confirmed in May, and the 16 affected customers were notified by registered mail in June. Further testing in July found additional vulnerabilities, and the portal, which has about 55,000 account holders, remains offline with no return date.

What was exposed

For the 16 accounts, the data included full name, email address, service address, account, customer and user IDs, and security questions and answers. The database held no credit card or banking information. Halifax Water said this was not an attack on its own systems, and that its payment and operational systems, including water and wastewater controls, were not affected.

CEO Kenda MacKenzie apologized. The utility says it has changed ticket routing and escalation, added cybersecurity training and is reviewing its vendor contract and oversight.

What to do

• Customers who reused their Customer Connect security answers elsewhere should change them.
• Use unique passwords and turn on multi-factor authentication where offered.
• Halifax Water says it will not call, email or text asking for personal information about this incident.

For other organizations, the lesson is to give researchers a clear way to report vulnerabilities and to retest fixes after every vendor update.