An independent forensic investigation has determined 16 customer accounts were accessed in a Halifax Water privacy breach that has left their online portal out of service for the last five months. The water utility shut down its customer connect portal on March 6 after it detected an unauthorized access to its information. Halifax Water says the portal, which was built on a third-party platform, had a vulnerability that allowed an external party access to the information. “This was not a cyber security attack on Halifax Water’s systems, nor did it involve the systems that control water and wastewater services,” a news release from Halifax Water reads. Customers impacted A cybersecurity firm conducted an independent review of the incident and in May they determined 16 customer accounts were accessed. Those customers were notified by mail in June. Roughly 55,000 customers have accounts with the Halifax Water online portal. The accessed information included: Halifax Water says no financial information was exposed during the incident, but it encourages customers to change any reused passwords and alter security questions and answers. Warning dismissed as spam The utility says it identified a vulnerability in the portal last November and reported it to the vendor. A patch was applied, but a software update in January rendered it ineffective and re-exposed the vulnerability. In February an unknown third party emailed the customer service team about the vulnerability, but it was dismissed as spam. The same party followed up in March and it was reported to the help desk. “The ticket was escalated to the cyber security team and triggered the full response,” the release reads. “Cyber security awareness training has increased across the organization, and internal ticket routing and escalation processes have been updated to immediately flag and escalate these types of security-related reports from outside the organization.” Portal still offline Halifax Water says its customer portal will remain offline due to security tests that have identified additional vulnerabilities. The original vulnerability has been fixed and confirmed effective. There is no set restoration date for the portal. “Halifax Water will communicate a timeline once one is confirmed,” the release reads. “In the meantime, bills are being sent by mail, and Halifax Water apologizes for the inconvenience.” For more Nova Scotia news, visit our dedicated provincial page
