{"id":"london-hydro-portal-data-breach-jun-2026","category":"breach","status":"closed","title":"London Hydro portal flaw exposes customers' contact and account details; man charged","tldr":"A flaw in London Hydro's (Ontario, Canada) customer portal let someone download customers' names, contact details, service addresses and meter details between 5 and 17 June. It's fixed and a man is charged.","summary":"Between 5 and 17 June 2026, an individual accessed London Hydro customer accounts without authorisation and downloaded customer information through a technical flaw in the Ontario utility's website portal. London Hydro says the data included full name, email, mailing address and phone number, plus account number, service address, pricing plan, contract start date, and meter number and type. It says no dates of birth, government ID, payment card or banking details, or passwords were involved. The number of affected customers has not been disclosed. London Hydro reported the matter to police on 19 June, announced it on 20 June, and says the flaw has been corrected. It is contacting affected customers directly and offering Equifax credit monitoring. On 2 October, London Police said a 40-year-old London man had been arrested and charged with fraudulently obtaining a computer service and mischief over $5000, after devices seized on 13 August were examined. He is due in court on 29 December 2026. The case is ongoing, and the charges are allegations not yet tested in court.","action":"If you're a London Hydro customer, treat unexpected bills, payment-change requests, and calls, texts or emails claiming to be from the utility with suspicion. Use your Equifax code if you received a notice, and contact London Hydro on 519-661-5503 if unsure.","product":"London Hydro customer portal (Ontario, Canada)","audience":"home","severity":"medium","patch":"na","exploited":true,"cves":[],"tags":["london-hydro","utility","canada","data-breach","customer-portal","arrest","phishing-risk"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Data Security Incident","url":"https://www.londonhydro.com/data","by":"London Hydro","date":"2026-10-05"},{"kind":"news","title":"Man facing charges following investigation into data breach","url":"https://www.londonpolice.ca/news/posts/man-facing-charges-following-investigation-into-data-breach-26-60416/","by":"London Police Service","date":"2026-10-02"}],"started":"2026-06-05","closed":"2026-10-05","created":"2026-11-03T22:01:07.955Z","updated":"2026-11-03T22:01:07.955Z","cve_notes":[],"timeline":[{"at":"2026-10-05","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"London Hydro posted a further update on the charges and said it will share more as it becomes available.","url":"https://www.londonhydro.com/data","by":"London Hydro","patch":null},{"at":"2026-10-02","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Police announced a 40-year-old London man was arrested and charged with fraudulently obtaining a computer service and mischief over $5000. His next court date is 29 December 2026.","url":"https://www.londonpolice.ca/news/posts/man-facing-charges-following-investigation-into-data-breach-26-60416/","by":"London Police Service","patch":null},{"at":"2026-08-13","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Police executed a search warrant at a London residence and seized several electronic devices. Forensic examination later linked the suspect to the access.","url":"https://www.londonpolice.ca/news/posts/man-facing-charges-following-investigation-into-data-breach-26-60416/","by":"London Police Service","patch":null},{"at":"2026-06-29","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"London Hydro posted details of Equifax credit monitoring offered to eligible affected customers by notice.","url":"https://www.londonhydro.com/data","by":"London Hydro","patch":null},{"at":"2026-06-26","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"London Hydro confirmed a technical issue in its portal let an unauthorised third party access and download some customers' data. It said the issue was corrected and that no financial or government ID information was involved.","url":"https://www.londonhydro.com/data","by":"London Hydro","patch":"patched"},{"at":"2026-06-20","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"London Hydro announced it was investigating unusual activity on its website portal that may have affected personal information on some accounts.","url":"https://www.londonhydro.com/data","by":"London Hydro","patch":null},{"at":"2026-06-19","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"London Hydro reported a suspected compromise of its customer information to London Police.","url":"https://www.londonpolice.ca/news/posts/man-facing-charges-following-investigation-into-data-breach-26-60416/","by":"London Police Service","patch":null},{"at":"2026-06-05","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Police say an individual began accessing London Hydro customer accounts without authorisation. The access ran until 17 June.","url":"https://www.londonpolice.ca/news/posts/man-facing-charges-following-investigation-into-data-breach-26-60416/","by":"London Police Service","patch":null}],"url":"https://hard.fyi/live/london-hydro-portal-data-breach-jun-2026/","json":"https://hard.fyi/api/live?id=london-hydro-portal-data-breach-jun-2026"}