As previously reported, Nova Scotia Power confirmed that it had been the victim of a ransomware attack in March but had not paid the ransom demands. They declined to publicly name the threat group or individual responsible. Their most recent incident update of June 25 provides some additional information for customers.
On July 3, Nova Scotia Power notified the Maine Attorney General’s Office that “To date, approximately 280,000 Nova Scotia Power customers have been identified as being impacted by the incident,” of which 377 were Maine residents. According to their notice, consumers were sent notification letters on June 6.
The sample notification letter appended to the company’s submission explains:
On April 25, 2025, Nova Scotia Power discovered that an unauthorized third party had gained access to certain parts of its Canadian network and servers. Nova Scotia Power immediately took steps to contain the activity and investigate the incident. While the investigation remains ongoing, we have determined that certain customer information stored on the impacted servers was accessed and later acquired by an unauthorized third party between approximately March 19, 2025 and April 25, 2025. On May 8, 2025, Nova Scotia Power determined that the acquired customer information may have included some of your personal information.
The types of information depended on what the customer provided:
The types of impacted information varied by individual customer and depended, in part, on the information provided by each customer. This may have included one or more of the following: name, phone number, email address, mailing and service addresses, Nova Scotia Power program participation information, date of birth, customer account history (such as power consumption, service requests, customer payment, billing and credit history, and customer correspondence), driver’s license number, and Canadian Social Insurance Number. For some of our customers, bank account numbers (for pre-authorized payment) may also have been impacted, if this information was provided by these customers.
Those affected are being offered two years of a credit monitoring service by Cyberscout.