Back Globalnews.Ca

Nova Scotia Power doesn't know why hacked customer data wasn't previously deleted

Globalnews.Ca • August 18, 2026

Nova Scotia Power officials say they don’t know why a digital copy of almost three decades worth of customer information that was later stolen in a cyberattack was not automatically deleted as intended.

The information, containing the personal data of hundreds of thousands of customers, was accessed in March 2025 by what the company has said it believes were Russia-based actors.

It contained addresses, phone numbers, banking information, social insurance numbers and other customer data.

Executive Blake Williams told a regulatory hearing that the company has mechanisms to automatically delete certain data in cycles of no more than 90 days.

He said the utility does not know why the file, created in 2021 and still present in the system in 2025, was never deleted.

If it had been destroyed as intended, Williams says the information would not have been available to the attackers.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Nova Scotia Power Data Breach: Customer Information Exposed in Cyberattack In March 2025, Nova Scotia Power suffered a cyberattack attributed to Russia-based actors, resulting in the theft of nearly three decades of customer data, including personal and financial information of over 370,000 customers. The company had intended to automatically delete this data every 90 days, but an oversight left it accessible. Blake Williams, a company executive, stated that the data was stored in Microsoft Azure and was not subject to the automated deletion process due to a manual setup error. The breach disrupted the utility's billing system, leading to inflated customer bills. Following the incident, the Office of the Privacy Commissioner of Canada launched an investigation, and Nova Scotia Power committed to deleting all social insurance numbers from its system. The company ceased collecting these numbers in 2018 but faced challenges in purging existing records. As of now, the company has returned to normal billing practices after a year of disruption. 2 sources 71

Extracted Entities

Nova Scotia Power doesn't know why hacked customer data wasn't previously deleted

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Countries (1)