Nova Scotia Power granted extension to provide information on cybersecurity breach

The Nova Scotia Power building is pictured in downtown Halifax. (Jonathan MacInnis/CTV Atlantic)

Nova Scotia Power, which was originally ordered to provide a litany of information on the cybersecurity breach no later than Aug. 15, now has until early September to file the report.

The Nova Scotia Energy Board, which is conducting a full investigation into the cyberattack last March, ordered the power utility to submit a detailed report on the incident, along with monthly updates, this year.

On July 24, it also asked Nova Scotia Power to provide answers to a list of questions, including:

• when was the breach detected?
• how many current and former customers were impacted?
• what is the communication policy for a cyberattack?
• which customer services were affected by the breach?
• if a customer requested it, could the utility provide details about their specific compromised personal information?

On Aug. 14, a day before Nova Scotia Power was scheduled to submit answers to these questions, the utility requested an extension to Sept. 5.

“Given that NS Power’s investigation into the incident is ongoing and work in relation to the cybersecurity matter continues, additional time is required in the circumstances to enable NS Power to address the IRs (information requests) appropriately,” a letter from the utility reads.

The Energy Board granted the extension request, but noted it would appreciate if Nova Scotia Power could provide responses prior to Sept. 5.

“These information requests seek information frequently requested by NS Power’s customers in their letters and emails to the Board expressing concerns, frustrations, and complaints about the compromise and misuse of their personal information, the risks relating to the release of their personal information, and difficulties encountered in communications with the credit monitoring service engaged by NS Power,” a letter from Energy Board reads. “The Board intended that NS Power’s responses to these questions would be available to customers who may be seeking answers to the questions that many of them are asking.”

The Energy Board had previously ordered the utility to file its monthly updates starting Aug. 1, but Nova Scotia Power requested an extension on that as well.

History of cyberattack

Nova Scotia Power detected “unusual activity” on its network on April 25, but later learned the breach actually happened on or around March 19. It informed the public about the “sophisticated ransomware attack” on May 23.

The utility previously said up to 280,000 customers were affected by the attack, which possibly compromised names, phone numbers, email addresses, social insurance numbers and mailing addresses.

Nova Scotia Power is offering five years of free credit monitoring to all current and former customers. It also said it would delete all social insurance numbers of customers from its files.

Along with the Energy Board, the Office of the Privacy Commissioner is also investigating the cyberattack.

For more Nova Scotia news, visit our dedicated provincial page