N.S. couple loses $30K, believes it’s due to power utility’s cybersecurity breach

A Nova Scotia couple says they lost thousands of dollars in what they allege was part of a cybersecurity hack involving Nova Scotia Power.

A Nova Scotia couple says they’re devastated after losing $30,000 from their bank account, which they believe is tied to Nova Scotia Power’s recent cybersecurity breach.

Diane and her husband Michael Betts say they discovered the loss on May 15 when Diane logged onto their Manulife Bank account and noticed two transactions she didn’t recognize: a $500 payment to their MasterCard, followed by a $30,000 transfer from their line of credit.

“We were in absolute shock,” said Diane. “We’ve never been in debt - and suddenly we owe $30,000. It wasn’t our mistake.”

The Betts say they immediately called Manulife, where a representative told them their account had been accessed the day before by someone claiming to be Diane, with all of her information in hand.

“The only way they could’ve convinced the customer service agent they were me is if they had everything,” she said. “That’s when we started asking how anyone got that kind of access.”

It wasn’t until May 23 that the couple received a letter from Nova Scotia Power confirming their personal information had been compromised in a recent cybersecurity breach.

“It all clicked after that,” said Diane. “All the dots connected. This was the breach.”

The couple, who has had an account with the utility for 50 years, say they never would’ve imagined such sensitive data was still stored, let alone vulnerable.

“We weren’t doing anything online to generate the opportunity for someone. We don’t give our information. We are private people to start with,” said Michael.

They say the timing of the letter was particularly frustrating, as it arrived more than two months after news of the breach first surfaced publicly.

“If we had gotten that letter in early April, we would have taken immediate steps, added alerts, changed our passwords,” said Diane. “Instead, we spent the entire long weekend in May not knowing what had happened.”

Manulife has since launched an investigation and placed the couple’s case with its legal department. The Betts say their investigator has been helpful and told them their account would be reset later this week. However, the couple doesn’t know whether they’ll be reimbursed - or by whom.

“There’s been no answer from Nova Scotia Power. They won’t take calls unless it’s about outages or setting up a new account,” said Diane.

The Betts say their priority besides getting their money back is to find out exactly what personal data was leaked.

“We’re retired. My husband works part-time by choice. This is a huge financial burden for us,” Diane said. “We didn’t fall for a phishing scam. We didn’t share our info. This happened because of someone else’s negligence.”

Nova Scotia Power previously disclosed it had been the target of a cybersecurity incident in March. It later confirmed it was the victim of a “sophisticated ransomware attack” and data stolen from its systems has been published.

“We know the current cyber incident is concerning for many customers,” said Chris Lanteigne, director of customer care. “We encourage any customer who receives a letter from us about their personal information being impacted, to please sign up for the free comprehensive credit monitoring services being offered. It’s one of the best ways to protect yourself, your personal information and your credit from any potential impacts.”

The couple has spoken with police, who confirmed the Betts had filed a report; however, it is still in its early stages. Halifax police say as of now, they do not have evidence linking the fraud to the utility’s cyber breach.

The Privacy Commissioner of Canada also said it is aware of the matter and is in communication with the utility company.

For more Nova Scotia news, visit our dedicated provincial page