Halifax Water breach raises questions about ethical hacking

CBC News reports that in February, Halifax Water received a tip from an unknown third party about a vulnerability in the utility's Customer Connect portal. The email was dismissed as spam.[1] CBC says that when the third party followed up a month later, the issue was escalated all the way to the cybersecurity team.[1]According to CBC, the portal was taken offline and, following an investigation, Halifax Water found that information from 16 customer accounts had been accessed.[1] CTV News reported in August that the breach had left the portal out of service for the last five months.[2]Chuks Awunor, who founded cybersecurity company GuardsArm, told CBC that dismissing the tip shouldn't have happened, "Because it seems they don't have a channel where tips like this could be reported and action taken."[1]Dalhousie University cybersecurity professor Srini Sampalli told CBC that good intentions alone do not make a hacker ethical.[1]"I would say the critical difference is authorization,"[1] he said.CBC reports that Sampalli says the tip coming from an unauthorized third party makes the Halifax Water situation complicated.[1]Halifax Water told CBC News that it wouldn't comment publicly on specific vulnerabilities, security testing activities or details of its cybersecurity controls.[1] In its statement, the utility said it "takes cybersecurity seriously and has processes in place to review and respond to security issues."[1]