Federal privacy commissioner launches investigation into NS Power data breach

The federal privacy commissioner has launched an investigation into Nova Scotia Power’s data breach.

The Office of the Privacy Commissioner of Canada has launched an investigation into the data breach at Nova Scotia Power that affected hundreds of thousands of customers.

Privacy Commissioner Philippe Dufresne said Nova Scotia Power submitted a breach report to his office. After receiving complaints about the breach, he started an investigation under the Personal Information Protection and Electronic Documents Act.

“We are actively engaging with the organization to ensure that it is taking appropriate steps to respond to the incident, and my immediate focus is on ensuring that the company is effectively addressing the breach and protecting the personal information of its customers,” Dufresne said in a news release. “This includes breach containment, notification and measures to reduce risks to those affected.”

Last week, the power utility said it was the “victim of a sophisticated ransomware attack” on March 19. A spokesperson said roughly 280,000 customers were impacted by the breach.

The utility detected “unusual activity” on its network on April 25 and launched an incident response plan.

Nova Scotia Power has indicated the stolen information could include names, phone numbers, addresses, birth dates, social insurance numbers and bank account information.

The utility has arranged to supply affected customers with a two-year subscription for a credit monitoring service through TransUnion at no cost.

“Data breaches have surged over the past decade and this incident highlights the growing risks of cyberattacks for all organizations,” Dufresne said. “Prioritizing information security is essential to respond to a threat environment that is continuously evolving.”

For more Nova Scotia news, visit our dedicated provincial page