London Hydro

On June 20, 2026, London Hydro announced a data security incident involving unauthorized access to customer personal and account information. London Hydro distributes electricity to over 160,000 customers in and around London, Ontario.

The company stated it is investigating an incident that "may have impacted a portion of personal information on some accounts" and has begun notifying affected customers. The full extent of the breach, including the attack method and whether data was exfiltrated, remains under investigation.

Customer names, addresses, email addresses, phone numbers, account and billing numbers, service addresses, pricing plans, contract start dates, and meter information. Notably, London Hydro stated that sensitive financial data—banking information, payment card details, dates of birth, and government-issued identification—was not involved.

While financial data appears unaffected, the exposed information still enables targeted attacks. Account numbers combined with billing information and service addresses reveal customer relationships with the utility. Meter data and pricing plans reveal usage patterns and contract terms.

London Hydro customers—residential and commercial accounts across the region. The exposed data enables highly convincing phishing campaigns. Attackers can craft fake billing notices that reference real account numbers. They can impersonate utility communications with accurate service details.

Utility companies have built-in trust. Customers expect communications about billing, service changes, and account status. The legitimacy of the data makes fraudulent communications harder to distinguish from real ones. London Hydro is warning customers about suspicious communications and unfamiliar account activity.

London Hydro appears to have segregated financial data from operational customer data. Banking details, payment cards, and government IDs were stored separately from account and billing information. That segmentation limited the exposure scope.

But attackers accessed the customer database containing everything else. The account information, contact details, and service data that utilities need for daily operations was in the compromised systems. Protecting financial data is necessary but not sufficient when operational data still enables fraud.

The breach notification references "a portion of personal information on some accounts." The phrasing suggests ongoing assessment of which customers were affected and what data was accessed. Complete visibility into breach scope requires knowing what existed in the compromised systems.

Utility customer databases span years or decades of service relationships. Account histories, address changes, meter replacements, billing adjustments. The data accumulates across the full history of customer relationships with the utility.

No threat actor has claimed responsibility. The attack method remains unclear. Ontario's privacy laws require breach notification when personal information is compromised. London Hydro has begun notifying affected customers and is working with cybersecurity experts on investigation.

Critical infrastructure breaches attract regulatory attention. Utilities operate essential services that affect public welfare. The investigation will need to determine not just what data was accessed, but whether grid operations or safety systems could have been affected.