Nova Scotia Power can’t explain why hacked customer data was not deleted as planned

HALIFAX – Nova Scotia Power officials say they don’t know why a digital copy of almost three decades worth of customer information that was later stolen in a cyberattack was not automatically deleted as intended.

The information, containing the personal data of hundreds of thousands of customers, was accessed in March 2025 by what the company has said it believes were Russia-based actors seeking a ransom. It contained addresses, phone numbers, banking information, social insurance numbers and other customer data.

Blake Williams, Nova Scotia Power’s vice-president of legal and regulatory affairs, said during a hearing Monday into the incident that the utility’s customer information system, launched in 1997, is essentially too old to be hacked. 

“It’s a little bit like if I were to ask my kid to operate a VCR,” he said during the Nova Scotia Energy Board hearing in Halifax. 

However, a second software system, Microsoft Azure, had made a copy of all that customer data in 2021 and was accessed through the phishing scam in 2025. Williams said Nova Scotia Power intended for the data to be automatically deleted on a cycle of no more than 90 days, as happened with other information in the Azure system, but that never happened. That left the customer data open to hackers four years later. 

“For obviously very unfortunate reasons, when this information was included in (Azure) it was not made subject to that automated process and that was an oversight,” said Williams. 

He said any automated system needs to first be set up manually by staff, but the utility can’t say why the data was missed. 

“We don’t definitively know, just because of the passage of time, exactly what happened or why it was not (deleted).”

Along with seeing the data of more than 370,000 customers stolen, the March 2025 cyberattack disrupted Nova Scotia Power’s automatic billing system, leaving the utility to estimate customer power usage. Politicians at the time said their constituents were reporting bills much higher than usual. A year after the attack, the company said billing had returned to normal.  

Premier Tim Houston criticized the company’s communications with customers, saying they were shouldering the financial consequences of the utility’s operational shortcomings. 

There were threats of a class-action lawsuit and the Office of the Privacy Commissioner of Canada launched an investigation that concluded with the company’s commitment to delete all social insurance numbers from its system. 

Williams said Monday that Nova Scotia Power stopped collecting SINs in 2018. He said the company’s ancient computer system wouldn’t allow existing numbers to be deleted, so the company began turning them all to zeros whenever it came across them in a customer file. He said the utility did not decide to purge all SINs from its system until 2024. 

However, the copy of the customer information system was made three years prior and had not been updated, meaning SINs deleted between 2021 and 2024 were still accessible to the hackers.  

David Roberts, a lawyer who served as the consumer advocate at the hearing, said the information puts a new cast on the events. 

“But for an error in the transportation of data within the company, there might not have been anything for whoever intruded into the system to have access,” he told reporters during a break from the hearing. 

Roberts said there seems to be a cultural change within Nova Scotia Power and he hopes improvements, such as a new customer information system that’s on the way, will lessen the chances of another attack. 

Interim Liberal Leader Iain Rankin renewed the party’s call for the government to launch an independent review of the utility. 

“Nova Scotians are being asked to pay higher power bills while Nova Scotia Power continues to make serious mistakes in how it manages its operations and customer information. That is not fair to ratepayers,” he said in a statement. 

NDP energy critic Susan Leblanc said Houston’s government has failed to protect the privacy of Nova Scotians.

“People want to be able to trust that the government will help them deal with the fallout from a data breach, and the NDP have introduced legislation that would do this and make sure companies are required to protect people’s sensitive information,” she said in a statement.

“The government should be standing up for Nova Scotians and make sure these protections are in place.”

The Energy Department said in a statement that the premier prompted the hearings so the company’s response could be assessed in public. It said it would reserve comment until the end of the process. “Nova Scotia Power failed customers through lack of readiness, privacy concerns, and poor communication. And that was followed by inaccurate estimated billing,” it said.

This report by The Canadian Press was first published Aug. 18, 2026.