London Hydro data breach may expose personal data of 160,000 electricity customers in Ontario
Over 160,000 electricity customers in London, Ontario may have had data exposed in a breach at London Hydro. An attacker used one account to exploit a system flaw and reach other customers' info: names, addresses, account and meter details. No banking or ID data was taken. Per Lo
A cyberattack on a Canadian electric utility has exposed how a single compromised account can cascade into a wider breach. London Hydro, which distributes electricity to more than 160,000 customers in and around London, Ontario, disclosed that it is investigating a data security incident affecting some customer accounts. According to the utility, its CEO became aware of suspicious activity on a customer account on June 18. The subsequent investigation found that the account had been used to exploit a system vulnerability, which in turn allowed access to certain information belonging to other customers. The potentially exposed data includes names, addresses, email addresses, phone numbers, account and billing numbers, service addresses, pricing plans, contract start dates and meter information. London Hydro says the incident did not involve banking information, payment card details, dates of birth or government-issued identification numbers, and that there is no indication its operational technology or grid systems were affected. No known cybercrime group has claimed responsibility, and the utility has not yet said how many customers were ultimately affected or exactly how the intrusion occurred. The detail that stands out is the entry point: not a phishing email or ransomware payload, but an ordinary customer account turned into a foothold to reach a shared system. For a utility, keeping billing and customer-facing platforms walled off from anything that touches grid operations is the difference between an embarrassing data leak and a safety incident. According to London Hydro.