Nova Scotia Power Cyberattack: What 280,000 Customers Need to Know About Stolen Data

Nova Scotia Power, the primary electricity provider for 550,000 customers across the province, has confirmed a sophisticated cyberattack resulted in the theft of personal data belonging to more than half of its customer base. Discovered in late April, the breach exposed sensitive information for approximately 280,000 customers, raising significant concerns about identity security and essential service disruption.

Key Takeaways:

• A cyberattack on Nova Scotia Power compromised data for about 280,000 customers.
• Stolen information varies but can include highly sensitive details like Social Insurance Numbers and driver’s licenses.
• NSP is working with experts, has notified affected customers, and is offering free credit monitoring.
• Customers are urged to take immediate steps to protect themselves from potential fraud and identity theft.

Details of the Nova Scotia Power Data Breach

The utility company reported that the cyberattack occurred on or around March 19. Upon discovering the breach on April 25, Nova Scotia Power initiated an investigation with external cybersecurity experts. The stolen information was later published by the cyberthief.

Peter Gregg, the company’s president and CEO, stated that the breach affected an estimated 280,000 customers, representing over half of their total customer base in Nova Scotia.

What Customer Information Was Compromised?

The specific types of personal information stolen vary for each affected individual, depending on the data previously provided to the utility. The compromised data may include one or more of the following:

• Customer name
• Phone number
• Email address
• Mailing and service addresses
• Nova Scotia Power program participation details
• Date of birth
• Customer account history (including power consumption, service requests, payment/billing/credit history, and correspondence)
• Driver’s licence number
• Social Insurance Number (SIN)

The inclusion of highly sensitive identifiers like SINs and driver’s license numbers significantly escalates the risk of identity theft for affected individuals.

Nova Scotia Power’s Response and Mitigation Efforts

Since identifying the security incident, Nova Scotia Power has been collaborating with cybersecurity specialists to assess the full impact and to securely restore and rebuild the affected systems.

The company confirmed it did not pay the cyberthief. Instead, over the past two weeks, NSP has been mailing notifications directly to customers confirmed to have been affected by the data theft.

As a measure to help mitigate potential harm, Nova Scotia Power has partnered with consumer reporting agency TransUnion. Affected individuals are being offered a complimentary two-year subscription to TransUnion’s comprehensive credit monitoring service, myTrueIdentity.

NSP has also advised customers to be highly vigilant regarding unsolicited communications that appear to be from the utility, such as emails, texts, or calls asking for personal information. They recommend avoiding clicking on suspicious links or downloading attachments without verifying the source.

Steps to protect personal data after a utility cyberattack, including password security and vigilance against phishing.Taking immediate protective measures can help minimize risks following the Nova Scotia Power data breach.

Actionable Steps for Affected Customers

If you are a Nova Scotia Power customer, especially if you have received a notification, it is crucial to take immediate action to protect yourself from potential identity theft and financial fraud.

Secure Your Online Accounts

• Change Passwords: Update passwords for all online accounts that may have used the same information or where you shared similar personal details.
• Enable Two-Factor Authentication (2FA): Add an extra layer of security to your accounts. 2FA requires a code from your phone or another device in addition to your password to log in.

Monitor Financial and Credit Activity

• Notify Financial Institutions: Contact your banks, credit card companies, and other financial institutions if you believe any banking or credit information shared with Nova Scotia Power may be compromised.
• Monitor Accounts: Regularly check your bank statements, credit card activity, and other financial accounts for any unauthorized transactions.

Take Steps with Credit Bureaus

• Request Fraud Alerts: Place a fraud alert with the three major national credit reporting bureaus: Equifax, Experian, and TransUnion. This alerts lenders to potential fraud and prompts them to contact you before granting credit in your name.
• Check Credit Reports: Obtain free copies of your credit reports from Equifax, Experian, and TransUnion and review them carefully for any suspicious activity, such as accounts or inquiries you don’t recognize.
• Consider a Security Freeze: Implement a security freeze on your credit report. This restricts access to your credit file, making it significantly harder for someone to open new accounts using your identity.

Utilize Assistance Offered

• Use the Credit Monitoring Service: Take advantage of the free two-year credit monitoring service offered by Nova Scotia Power through TransUnion. This service can help detect suspicious activity on your credit file.
• Contact Nova Scotia Power: Follow NSP’s guidance and contact them if you need assistance or have questions regarding the breach notification or the offered services.

Government Concerns Over Impact

The cyberattack has also drawn attention from provincial officials. Nova Scotia Energy Minister Trevor Boudreau expressed significant alarm in a letter to NSP’s CEO, Peter Gregg, dated May 7.

“This incident has raised significant alarm over the protection of customer data, reliability of electricity services and infrastructure,” Minister Boudreau wrote. He highlighted concerns about the disruption to essential services, including delays in power hook-ups and service connections for residents and businesses.

The Minister emphasized that these delays pose risks to health, safety, and economic stability, particularly for vulnerable individuals and small businesses reliant on uninterrupted electricity.

What’s Next?

The full implications of this data breach will unfold over time. While Nova Scotia Power is taking steps to secure systems and assist affected customers, the potential for identity theft remains a significant risk. Affected individuals must remain vigilant and proactive in monitoring their personal and financial information. The incident also raises broader questions about the cybersecurity resilience of critical infrastructure providers and the protection of sensitive customer data in the digital age.

For more information on protecting yourself from cyber threats and identity theft, consider exploring resources from reputable cybersecurity organizations or government agencies.