In a significant move, Nova Scotia’s energy regulator has announced a comprehensive two-part inquiry into a cyberattack that struck the province’s private power utility, Nova Scotia Power, in March 2025. The breach compromised the personal data of approximately 280,000 customers, with suspicions pointing to a Russia-based actor as the source of the attack. This dual investigation aims not only to dissect the technical failures surrounding the cyber incident but also to scrutinise the utility’s handling of customer data and billing practices in its aftermath.
Inquiries Launched Amidst Ongoing Customer Concerns
The Nova Scotia Energy Board has outlined plans for two distinct investigations. The first will delve into the cyberattack’s technical dimensions, assessing the utility’s cybersecurity infrastructure, policies, and recovery measures taken since the breach. The second inquiry will focus on customer service issues, specifically how Nova Scotia Power managed the collection and storage of customer information, its efforts to prevent fraud and identity theft, and its communication with customers regarding billing estimates.
Premier Tim Houston, who also serves as the energy minister, has been vocal about the rising power bills many constituents have faced since the attack. He has expressed dissatisfaction with the utility’s performance, particularly regarding inflated bills and the lack of clarity surrounding estimated charges. “Nova Scotians deserve better,” remarked Stephen Moore, the Premier’s communications director, emphasising the need for accountability. The government has called for a thorough investigation into these billing practices, which have left many customers feeling confused and financially strained.
Utility’s Response and Ongoing Challenges
Nova Scotia Power has acknowledged the upcoming inquiries and expressed its commitment to transparency. Jacqueline Foster, a spokesperson for the utility, stated that the company has been in regular communication with both the energy board and the federal privacy commissioner since the cyber incident. “We are fully committed to transparency and have been keeping our customers and regulators regularly informed,” she asserted.
The utility explained that billing estimates fluctuate based on seasonal temperature patterns, with a notable increase in November due to the shift to ‘cold month’ estimates. This change, they argue, has led to unexpected spikes in bills, rather than the gradual adjustments that customers typically experience as temperatures drop.
Legal Challenges and Future Rate Increases
In addition to the inquiries, Nova Scotia Power is facing potential legal action from customers. A class-action lawsuit has been proposed by Halifax-based MacGillivray Injury and Insurance Law, alleging governance failures and inaccuracies in billing that have affected a substantial number of customers. The lawsuit is yet to be tested in court.
Moreover, the utility has put forth a proposal for residential rate increases of approximately 8 per cent to take effect next year. If approved, these increases would see a 3.8 per cent hike retroactively applied from January 1, followed by a further 4.1 per cent increase from January 1, 2027. This situation raises concerns about the affordability of power in the province amid ongoing governmental promises to maintain reasonable rates.
Why it Matters
The unfolding situation at Nova Scotia Power is critical not only for the immediate stakeholders but also for the broader discourse on cybersecurity and consumer rights within public utility sectors. As the inquiries progress, they could set important precedents for how utility companies manage data security and customer relations, especially in an era where digital threats are increasingly prevalent. The outcomes may ultimately shape public trust in essential services and influence regulatory frameworks governing data privacy and utility billing practices across the province and beyond.
