Halifax Water has assured customers that paper bills will continue to be sent out as they work to resolve a recent privacy breach affecting 16 accounts. The web portal allowing access to bills has been down since March due to the incident.
An independent forensic investigation revealed that a vulnerability in the third-party platform supporting the Customer Connect portal allowed an external party to obtain personal information linked to the affected accounts. However, this breach did not compromise Halifax Water’s operational systems or services.
The accessed information for the 16 accounts included customer names, email addresses, service or home addresses, account details, and security questions and answers. Fortunately, no financial data was accessed.
Affected customers were notified in June through mail, providing details of the incident and steps to take, along with a direct line to a Halifax Water representative for assistance. The utility disclosed that around 55,000 customers have online accounts through the portal.
Following the identification of the vulnerability in the portal in November 2025, the issue was reported to the platform vendor, Avertra. Although a patch was initially applied, a subsequent software update in January 2026 made the patch ineffective, leading to the re-exposure of the vulnerability.
In response to the breach, Halifax Water has enhanced its cybersecurity testing and training, as well as bolstered processes to promptly identify and escalate security-related reports from external sources. Despite successfully fixing the initial vulnerability, further security assessments uncovered additional vulnerabilities, necessitating the portal to remain offline until a secure restoration can be completed.
The utility aims to provide more information once a restoration timeline is confirmed. In the meantime, customers can expect to receive their bills by mail.
