Energy board orders report from Nova Scotia Power about cyberattack ahead of public inquiry

The Nova Scotia Power building is pictured in downtown Halifax. (Jonathan MacInnis/CTV Atlantic)

The Nova Scotia Energy Board is ordering Nova Scotia Power to submit a detailed report on the recent cyberattack that compromised the personal information of hundreds of thousands of customers by the end of the year.

The energy board says the utility will also file monthly updates on its response to the cyberattack until the report is complete. The first update is due by Aug. 1.

“Once the report is filed, the Board will launch a public process to review both the report and NS Power’s planning for and response to the incident,” a news release from the energy board says. “The Board continues to work with MNP Digital, which is independently assessing the cybersecurity incident on behalf of Board Counsel and staff. NS Power has provided a high-level briefing about the incident to MNP, Board Counsel, and staff.”

In an open letter to Nova Scotia Power, the energy board laid out the requirements of the report, which include:

• an account of how the utility discovered the breach
• a description of the “attack vector”
• a timeline of the events
• identification of compromised data and systems
• specific details regarding the type and amount of exposed personal information
• evidence indicating the presence of the breach, such as suspicious files or unusual network traffic
• a description of how the breach happened
• identification of any vulnerabilities or security gaps that were exploited
• assessment of the financial, operational and reputational damage to Nova Scotia Power
• evaluation of potential harm to past and present customers and employees
• steps the utility took to mitigate and contain the breach, as well as steps taken to eliminate the threat
• a review of the utility’s policies and practices for collecting, retaining and using personal information
• recommendations to enhance security measures and improve communications

“While the Board appreciates that it will not be possible to publicly disclose certain information for security reasons and to mitigate impacts relating to personal and confidential information that was stolen, it is important that the Board’s inquiry be conducted publicly and as transparently as possible,” the letter reads. “Special considerations and procedures may be required when sensitive information is involved.

“The Board has received numerous letters and emails from NS Power’s customers expressing concerns, frustrations, and complaints about the compromise and misuse of their personal information, the risks relating to the release of their personal information, and difficulties encountered in communications with the credit monitoring service engaged by NS Power.”

Timeline of cyberattack

Nova Scotia Power told the public it was the “victim of a sophisticated ransomware attack” on May 23, but the actual incident happened months prior.

The utility detected “unusual activity” on its network on April 25 and initiated its response plan. The utility later confirmed the breach happened on or around March 19.

Nova Scotia Power previously said 280,000 customers were impacted by the incident, which potentially compromised personal information like names, phone numbers, social insurance numbers, email addresses and mailing addresses.

Due to the cyberattack, the utility is offering five years of free credit monitoring to all former and current customers. It also said it will be deleting all social insurance numbers of customers from its files.

Along with the energy board, the Office of the Privacy Commissioner is also investigating the incident.

For more Nova Scotia news, visit our dedicated provincial page