Halifax Water has decided to continue sending paper bills to its customers as it deals with a recent privacy breach affecting 16 accounts. The online billing portal for customers has been down since March due to the incident.
According to a recent update, Halifax Water conducted an independent forensic investigation with third-party cybersecurity experts, which revealed a vulnerability in the third-party platform supporting the Customer Connect portal. This vulnerability allowed an external party to access personal information associated with the 16 affected accounts. The utility clarified that this incident did not involve a cyberattack on its systems controlling water and wastewater services.
The accessed information for the 16 impacted accounts included customer names, email addresses, service/home addresses, account details, and security questions and answers. However, no financial data was compromised.
Halifax Water CEO Kenda MacKenzie expressed regret over the situation and assured that the affected customers were notified in June via mail, providing guidance on necessary steps to take and offering direct contact with a Halifax Water representative for any queries.
The utility disclosed that around 55,000 customers maintain online accounts through the portal. The timeline of events revealed that a vulnerability was identified in the portal in November 2025, which was reported to the vendor, Avertra. Despite applying a patch, a subsequent software update in January 2026 nullified the patch, exposing the vulnerability once again.
In a notable turn of events, a security alert related to the vulnerability in February was initially disregarded as spam by the utility’s customer care team. However, follow-up communication in March prompted further investigation by the cybersecurity team, leading to the portal being taken offline and engaging cybersecurity experts.
Halifax Water has now intensified cybersecurity measures, including enhanced testing and training, to promptly address and escalate third-party reports of vulnerabilities. While a fix for the original vulnerability was effective, subsequent security testing identified more vulnerabilities. The portal remains offline as efforts to restore it securely are ongoing, with no specified timeline for its reactivation.
The utility has pledged to provide updates once a restoration timeline is confirmed, urging customers to expect paper bills until then.
