Halifax Water Portal Breach Exposes 16 Customer Accounts After Initial Security Tip Dismissed
A vulnerability in Halifax Water's Customer Connect portal led to unauthorized access of 16 customer accounts after an initial tip from a third party was dismissed as spam. The utility has since expanded its cybersecurity testing and strengthened incident escalation processes.
In February, Halifax Water received a tip from an unknown third party regarding a vulnerability in the utility’s Customer Connect portal. The initial report was dismissed as spam. 
A month later, in March, the third party followed up on the matter. This prompted the issue to be escalated to the cybersecurity team, and the Customer Connect portal was subsequently taken offline. An investigation into the breach revealed that information from 16 customer accounts had been accessed.
Chuks Awunor, founder of GuardsArm, criticized Halifax Water for lacking a proper channel to report and act on security tips, stating that the initial dismissal should not have happened.
Cybersecurity expert Srini Sampalli addressed the nature of the incident, noting that authorization is the critical difference between ethical hacking and unauthorized access. He emphasized that good intentions alone do not make a hacker ethical.
In August, Halifax Water announced it was expanding its cybersecurity testing and strengthening escalation processes for security-related incidents. 