Toronto Hydro online accounts hacked

Toronto Hydro Data Breach exposes e-billing system activity, triggering a privacy investigation into customer account data. Officials warn of identity theft and phishing risks as Ontario's utility notifies customers and cooperates with police.

Toronto police have launched an investigation after as many as 179,000 Toronto Hydro customer account numbers were illegally accessed in the company's electronic billing system.

Toronto Hydro says it contacted police after detecting atypical activity in its e-billing system. "We saw some unusual activity on our systems, and whenever there is more than the normal use of our system, a protocol distinct from grid events like the May 27 power disturbance reported by Hydro One, the system shuts down and notifies IT staff," said David O'Brien, president and CEO of Toronto Hydro.

"What was being accessed was the file that contained the customer account number, their name and address. We're very confident it doesn't go deeper than that, no financial information was obtained," said O'Brien, who noted Hydro was concerned the information might be used to obtain credit card or personal information from customers, as utilities warn about scams to help prevent such fraud.

"It's a total outrage when the provincial government has been paying lip service to fighting identity theft and a major public utility has exposed close to 200,000 people to that very sort of thing," said Peter Kormos, NDP consumer protection critic, though separate from reliability issues like a sprinkler-related blackout that also raised concerns.

Ontario's Information and Privacy Commissioner Ann Cavoukian was notified of the breach and is investigating as well.

"The last bill(s) to 179,000 customers were accessed online," said Bob Spence, spokesman for the office of the Information and Privacy Commissioner. "Any time a privacy investigation is launched, we look at what happened and how it might be prevented, including alerts like PowerStream phone-scam notices that inform customers."

O'Brien says Toronto Hydro will be sending a letter to each of its 685,000 customers, explaining about the privacy breach. It will not be telling customers if their account information was among those accessed, however.

"We're aware of the situation, and we'll be monitoring developments amid Hydro One service concerns across the sector," said Eric Pelletier, a spokesman for the Ministry of Energy and Infrastructure.

Related News

• Electricity Forum News

• Utility Operations News