London Hydro data breach exposes customer account information

On 20 June 2026, London Hydro — the electricity distribution utility serving roughly 170,000 residential, institutional, commercial and industrial customers in London, Ontario — disclosed a data breach that may have exposed personal and account information belonging to some of its customers. The company said it had first noticed suspicious activity on a customer account on 18 June 2026 and immediately began investigating.

According to the utility, the compromised account was used to exploit a vulnerability in its systems, which in turn allowed access to certain information about other customers. London Hydro said it is proactively reaching out to impacted customers and is working with local law enforcement, though it has not disclosed how many people were affected.

What was exposed

The information that may have been accessed includes customer contact details — names, addresses, email addresses and phone numbers — as well as account data such as account and billing numbers, service addresses, pricing plans, contract start dates, and meter numbers and types.

London Hydro stressed that the incident did not involve dates of birth, government-issued identification numbers, payment card details, banking information or other sensitive financial data.

Why it matters

The breach highlights how a single compromised customer-facing account, combined with an unpatched application flaw, can be leveraged to reach data belonging to a much wider population of users. For a critical-infrastructure operator such as an electricity distributor, even a breach limited to billing and contact information carries elevated stakes: the exposed details are exactly the kind of data that fuels convincing follow-on phishing and social-engineering campaigns against utility customers. Several outlets noted that key facts — including the number of customers affected and whether data was exfiltrated — remained unclear in the days after disclosure.