Nova Scotia Power says it was victim of ‘sophisticated ransomware attack’

Nova Scotia Power says the utility was victim of a sophisticated ransomware attack.

Nova Scotia Power has confirmed it was the “victim of a sophisticated ransomware attack,” and data stolen from its systems has been published, as it continues to investigate a cyberattack on the utility.

“Since the incident began several weeks ago, Nova Scotia Power has been actively working with the assistance of third-party cyber security experts to restore our systems safely and investigate the incident,” said the utility in a news release Friday.

“We have also been working to further strengthen our systems and add additional security protections.”

Nova Scotia Power says it hasn’t made any payments to the “threat actor,” based on guidance from law enforcement.

“We have learned that the threat actor has published data that was stolen from our systems,” said the utility. “We are actively working with cybersecurity experts to assess the nature and scope of the information that may have been impacted.”

A spokesperson told CTV News Friday that 280,000 Nova Scotia Power customers are affected by the breach.

Nova Scotia Power previously said an unauthorized third party accessed and stole customer information stored on certain servers on or around March 19.

It said it detected “unusual activity” on its network on April 25 and immediately initiated an incident response plan, which included launching its own investigation and contacting law enforcement.

Nova Scotia Power informed the public about the incident on April 28.

Cybersecurity expert David Shipley says, while Nova Scotia’s Power’s response may feel slow to some customers, it is “pretty fast by Canadian standards.”

“Nova Scotia Power didn’t try to spin it as an IT glitch, they called it a cyberattack from the start and figuring out who hit them, deciding whether to pay or not, these are gut wrenching decisions. We’re hearing details in weeks, not months, and for regulated, publicly traded utility, this is radical transparency,” he said.

“They’re (NSP) the victim. There’s a whole world of bad actors out there. What hit them is criminal ransomware, which is better than being hit by a nation-state aiming to shut down power entirely, that’s the bigger fear.”

The utility is in the process of mailing notices, which include detailed information about resources and support, to accountholders affected by the breach.

Nova Scotia Power says the stolen information could include names, phone numbers, addresses, birth dates, social insurance numbers and bank account information.

“It surprised me. I was a little upset to say the least. I think I’m not alone, many consumers are worried about the safety of their personal information, especially financial details,” said Nova Scotia Power customer James Fera.

“This is serious. We’re talking about credit data, stuff that’s foundational to people’s financial lives. We expect a public utility, especially one worth billions, to have safeguards in place to protect this information. The responsibility is on them, not on us.”

Nova Scotia Power has arranged for TransUnion, a consumer reporting agency, to provide impacted customers with a two-year subscription to a comprehensive credit monitoring service at no cost.

The utility is urging customers to be cautious about unsolicited communications, including emails, text messages, and phone calls, and messages that appear to be from Nova Scotia Power, asking for personal information. It also says customers should avoid clicking on suspicious links or downloading attachments without confirming they’re from a legitimate source.

“We remain sincerely sorry that this issue has occurred,” said Nova Scotia Power in Friday’s statement.

“Protecting the privacy and security of information held by Nova Scotia Power is something we take very seriously.”

Shipley says, in order to have real change, the federal government must treat cybersecurity like national security.

“We need Ottawa to take this seriously. These ransomware gangs will keep targeting utilities. When Australia was hit, their prime minister acted fast and forcefully. Canada hasn’t shown that kind of urgency,” he said.

“The threats are too big for provinces to handle alone.”

The utility has applied to the Nova Scotia Energy Board to upgrade its cybersecurity. It’s asking for $6.8 million, but at this point the application has yet to be approved.

With files from CTV Atlantic’s Hafsa Arif.

For more Nova Scotia news, visit our dedicated provincial page