London Hydro Discloses Customer Data Exposure After Security Incident

London Hydro, a Canadian utility serving more than 160,000 customers, disclosed a security incident that may have exposed customer personal and account information. The potentially affected data includes names, and service addresses, email addresses, phone numbers, account and billing numbers, pricing plans, contract start dates, and meter information. The company said banking details, payment card data, dates of birth, and government-issued identification numbers were not involved, and it has begun notifying affected individuals.

The utility has not disclosed how the intrusion occurred, whether data was exfiltrated, how many customers were affected, or whether ransomware, extortion, third-party systems, or operational technology played a role. London Hydro warned that the exposed account details could make phishing, impersonation, and fraudulent billing scams more convincing, and advised customers to watch for suspicious communications, unexpected bills, unfamiliar account activity, and requests to change payment arrangements.

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.

2 events from the most recent confirmed update back to the earliest known activity.

The utility said it has started notifying affected individuals the incident and advised them to monitor for suspicious communications, unfamiliar account activity, unexpected bills, and fraudulent payment-change requests. The company did not disclose how many customers were affected or whether data was exfiltrated.

London Hydro disclosed a data security incident that may have exposed some customers' personal and account information, including names, addresses, details, account and billing numbers, service addresses, pricing plans, contract start dates, and meter information. The utility said banking details, payment card data, dates of birth, and government-issued ID numbers were not involved.

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

2 references tracked. Mallory keeps watching after this page renders.

Map indicators from this story to your assets and identify affected systems in minutes.

Every observed campaign, victim, and pivot linked to actors named in this story.

Malware, exploits, and IOCs connected to the activity described here.

YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Get matching new stories delivered to your team as they break — not the morning.

Ask questions this story and take action on the answers.