London Hydro says portal flaw let intruder download customer account data
London Hydro, the electricity distributor serving London, Ont., said in June that an unauthorized third party exploited a technical issue in its customer website portal to access and download customer information, and began notifying affected account holders.
Utility account records pair names and addresses with account numbers and billing details, which makes them useful for scams that pose as the utility and threaten disconnection unless a payment is made.
What happened
According to the company's incident page, London Hydro noticed unusual account activity on its portal in mid-June. It says it began investigating the same day, corrected the technical issue to stop further access, reported the matter to the London Police Service and hired outside forensic experts. Its first public notice was posted June 20.
The company says the data that may have been taken includes customers' full names, email and mailing addresses, phone numbers, London Hydro account numbers, service addresses, pricing plans, contract start dates, and meter numbers and types. London Hydro says passwords, dates of birth, government ID numbers, payment card details and banking information were not affected, so customers do not need to reset their passwords. The incident was also tracked in a Bright Defense breach roundup citing SecurityWeek.
The utility offered eligible customers Equifax Complete Premier credit monitoring, with activation codes sent in individual notices. On Oct. 2, the company's update says, the London Police Service announced that a London man had been charged in connection with the unauthorized access.
What we don't know yet
London Hydro has not said how many of its customers are affected or described the technical flaw in detail.
What to do
- Be wary of messages about unexpected bills, account changes or new payment methods. London Hydro says it will never ask for banking or card numbers by email or text.
- Contact the utility only through details on its official website, at 519-661-5503 or [email protected].
- Activate the Equifax monitoring offered in your notice.
- Report suspicious messages to the Canadian Anti-Fraud Centre at 1-888-495-8501.
