Halifax Water – which suffered a privacy breach in March – will have a hearing on its cybersecurity readiness later this year. The Nova Scotia Regulatory and Appeals Board launched an investigation into Halifax Water’s cybersecurity readiness, which will include a paper hearing this fall. In March 2023, the municipality’s auditor general conducted a supervisory control and data acquisition (SCADA) system audit on Halifax Water. They found several deficiencies with the utility’s cybersecurity readiness and made 21 recommendations, including updating its IT cybersecurity strategy, “The cybersecurity program at Halifax Water is not as mature as I expected for a utility responsible for critical public infrastructure,” the auditor general said at the time. Two years later, the auditor general conducted a follow-up report that found Halifax Water had only completed 10 of the 21 recommendations by April 2025. Later that year, Halifax Water issued a letter to the board that said they had completed 16 of the recommendations by November. The outstanding incomplete recommendations included developing processes to manage physical access, implementing a process to track an inventory of spare parts and implementing SCADA cybersecurity procedures. “The organization acknowledges both its progress in achieving cyber security goals and the ongoing need for vigilance in response to evolving threats, particularly those affecting critical infrastructure,” the letter reads. “To this effect, improvements have been made to our capabilities to identify and govern risks, to protect our networks, and to respond and recover from cyber security incidents.” Privacy breach On March 6, Halifax Water shut down its customer connect portal after it detected unauthorized access to its information. The portal is still offline. “This was not a cyber security attack on Halifax Water’s systems, nor did it involve the systems that control water and wastewater services,” a news release from Halifax Water reads. The utility said an independent forensic investigation found 16 customer accounts were accessed by the privacy breach. Those customers were notified in June. The impacted information included email addresses, full names, and security questions and answers. Roughly 55,000 customers have accounts with the Halifax Water online portal. For more Nova Scotia news, visit our dedicated provincial page
