Nova Scotia Power Data Breach: Customer Information Exposed in Cyberattack

In March 2025, Nova Scotia Power suffered a cyberattack attributed to Russia-based actors, resulting in the theft of nearly three decades of customer data, including personal and financial information of over 370,000 customers. The company had intended to automatically delete this data every 90 days, but an oversight left it accessible. Blake Williams, a company executive, stated that the data was stored in Microsoft Azure and was not subject to the automated deletion process due to a manual setup error. The breach disrupted the utility's billing system, leading to inflated customer bills. Following the incident, the Office of the Privacy Commissioner of Canada launched an investigation, and Nova Scotia Power committed to deleting all social insurance numbers from its system. The company ceased collecting these numbers in 2018 but faced challenges in purging existing records. As of now, the company has returned to normal billing practices after a year of disruption.

Key Points: • Over 370,000 customers' personal data was stolen in a cyberattack attributed to Russian actors. • Nova Scotia Power failed to delete sensitive data due to an oversight in their automated processes. • The breach disrupted billing systems, causing inflated bills for customers.