NS Power says its response to cyberattack was ‘effective’ in redacted final report

Nova Scotia Power has released a redacted report on last spring’s cyberattack.

Nova Scotia Power says its response to the cyberattack earlier this year was “effective and executed in a very timely and highly coordinated manner” in a redacted incident report submitted to the Nova Scotia Energy Board.

The board, which is investigating the power utility’s response to the cyberattack that potentially compromised the personal information of hundreds of thousands of current and past customers, called for a full incident report due by Dec. 31. Nova Scotia Power submitted the report on Dec. 22.

Parts of the report are currently unavailable to the public as Nova Scotia Power has released a redacted version. The energy board is able to see the full report, but the utility is requesting certain information be kept confidential.

“The Board will review the contents of the report and confidentiality request before making a determination,” the energy board said in a news release.

Nova Scotia Power is seeking for the following information to remain confidential:

• timeline of the incident
• compromised systems
• data and personal information
• mitigation and restoration activities
• customer notification timeline
• enhancing security measures

As part of the investigation, the energy board ordered the power utility to issue monthly reports on the incident ahead of this full report starting last August.

FBI notified

In its full report, Nova Scotia Power said it believes an unauthorized third party gained access to their system on or around March 19 and exfiltrated certain data on or around April 25. Employees discovered some applications in the system were not functional and the company activated its incident response.

The power utility notified the RCMP, the Canadian Centre for Cybersecurity and the Canadian Security Intelligence Service. They informed the public of the breach in early May.

“Given the nature of the cyber attack, the critical infrastructure nature of the company and the North American electric utility industry, and the high confidence our advisors had of the identity of the threat actor, the Company also notified the Federal Bureau of Investigation (FBI),” the report reads.

Nova Scotia Power said it has no evidence the threat actor accessed any operational technology or energy delivery systems.

A previous report filed in September said all customers could have been impacted by the breach. The utility has reached out to roughly 375,000 customers who were identified as being affected by the incident.

“While NS Power recognizes the potential impact the Incident may have had on customers, Nova Scotia Power continues to have no evidence that this information has been further misused, or of any financial harm to customers resulting from this Incident,” the full report reads.

The power utility said it considered its containment, remediation and investigation of the incident was effective regarding the severity and complexity of the attack.

“At the same time, the Company recognizes—as a matter of sound governance and consistent with industry practice—that even an effective incident response will identify areas for refinement,” the report reads. “The Incident has provided NSP with valuable, practical, real-world insights that could not have been fully replicated through planning or exercises alone.”

Meters reconnected in March

The cyberattack disrupted the power utility’s bill process and meter data integration. As a result, the company has had to estimate electricity consumption for some customers’ bills. The move prompted criticism from Premier Tim Houston, who said customers have been dealing with inflated bills.

“Customer meters have continued to accurately record electricity usage,” the full report reads. “To date, approximately 75 percent of customers have now had at least one meter reading since the Incident, and the Company will continue to target the remaining 25 percent until communication with customer meters is re-established.”

Nova Scotia Power says all meters are expected to be reconnected by the end of March 2026. Other parts of the company aren’t expected to be fully restored until later next year, including MyAccount, which is set to be up and running again next September.

Earlier this month, Houston sent a letter to the energy board requesting they launch a formal investigation into the fairness and legality of the estimated billing methodology and the adequacy of consumer protections.

The board said it will investigate these issues and determine if they would be better addressed as part of the ongoing cybersecurity inquiry or as a separate matter.

“NS Power submits that many of the Premier’s requests of the NSEB by letter on December 3, 2025 have been already addressed through the various materials provided as part of this proceeding, or will be as part of future proceeding deliverables,” the full report reads. “Given the relation of the billing concerns to the Incident, it is appropriate to have them considered as part of this process.”

The Office of the Privacy Commissioner of Canada is also investigating the cyberattack and told CTV News Atlantic in early December it aims to finalize its review in the coming months.

SINs to be removed

The personal information impacted in the breach included customers’ birth dates and social insurance numbers (SINs).

In the full report, Nova Scotia Power said it collected SINs from customers as part of the authentication process prior to 2018, but they changed that practice and commenced a process to purge customer SINs from the customer information system in May 2024.

Last June the company committed to permanently deleting SINs that remained in its systems.

“This search has progressed significantly and is being conducted with the assistance of external experts,” the report reads. “Except where SINs are legally required for tax reporting purposes, any such information identified will be securely deleted. NS Power anticipates obtaining confirmation of its completion of this process by March 31, 2026.”

-With files from The Canadian Press

For more Nova Scotia news, visit our dedicated provincial page