The Nova Scotia Energy Board says Nova Scotia Power must settle all outstanding dues to its suppliers and vendors as soon as possible after the cyberattack last spring disrupted those payments. The Energy Board is investigating the cybersecurity incident and they have ordered Nova Scotia Power to submit monthly reports on the breach ahead of a full report due by the end of 2025. The November report noted the cyberattack impacted the ability to send timely payments on invoices for many vendors and suppliers, although the utility expects all dues to be settled by the end of the year. “The Board is concerned about the financial well-being of NS Power’s vendors and suppliers,” said Crystal Henwood, clerk of the Energy Board, in an open letter to Nova Scotia Power. Tim Houtsma, CEO of Marid Industries, told The Canadian Press his steel fabrication company is owed between $60,000 and $70,000. “It stretches your finances where they really shouldn’t be stretched,” he said. The Energy Board has directed Nova Scotia Power to settle its dues immediately and provide an update on any pending invoices in its January monthly report. “The Board will also refer this matter to MNP to further investigate causes of the NS Power’s financial technology data compromise and assess its data handling practices,” the letter reads. 2026 recovery A previous report from Nova Scotia Power said they expect to fully recover from the cyberattack by 2026. “There is still uncertainty about what tasks and actions are currently being undertaken, and what progress has been made to ensure that full recovery is achievable by 2026, as outlined in this update,” Henwood’s letter reads. The Energy Board has ordered the power utility to provide a Gantt chart that lays out the expected start dates, finish dates and completion for the summary tasks needed to achieve a full recovery. A Gantt chart is a bar chart that illustrates the progress of an activity. It will be due to the board by the end of 2025. “If no progress is made from one month to the next, this should also be clearly indicated along with the reasons,” the letter reads. The Energy Board also wants a separate chart that includes a list of board matters or proceedings that were impacted by the cyberattack. Cyberattack timeline Nova Scotia Power said it first found issues with its systems on April 25, but it later learned a “threat actor” had gained unauthorized access to parts of their system on or around March 19. They told customers about the breach in early May. The utility previously said roughly 277,000 customers were impacted by the breach – which potentially affected information like birth dates and social insurance numbers – but a September report revealed all customers could have been impacted. Following the incident, the Privacy Commissioner of Canada launched an investigation, which remains ongoing. -With files from The Canadian Press For more Nova Scotia news, visit our dedicated provincial page
