Nova Scotia Energy Board Reviews Cybersecurity Breach Report

The Nova Scotia Energy Board is currently reviewing a report detailing a recent cybersecurity breach involving Nova Scotia Power. The Board gained access to the incident report last week, following a deadline set for December 31, 2023, for submissions from the province’s energy utility. The utility has requested that certain information within the report remain confidential, a request that the Board will assess as part of its review process. In the meantime, a public version of the report has been released, albeit with several redactions.

Details of the Report and Utility Response

The 43-page report outlines Nova Scotia Power’s response to the breach. According to the utility, the measures taken—including containment, remediation, and investigation—were “effective and executed in a very timely and highly coordinated manner.” Despite acknowledging the potential impact on customers, Nova Scotia Power has stated there is no evidence that customer data has been misused or that any financial harm has occurred.

The report also highlights that 75 percent of smart meters have been reconnected, with the utility expecting to restore all connections by March 31, 2024. Furthermore, any social insurance numbers that are not necessary for tax reporting will be deleted by the same deadline.

Future Implications and Customer Assurance

As the Energy Board continues its examination of the report, the focus will remain on ensuring that customer data and financial information are safeguarded. The Board’s decision regarding the confidentiality request made by Nova Scotia Power will be significant in understanding the full scope of the breach and the utility’s future cybersecurity measures.

For now, Nova Scotia Power has expressed its commitment to transparency and customer safety, reaffirming that it is taking all necessary steps to address the breach effectively. The ongoing review by the Energy Board will help determine the next steps in ensuring that such incidents do not occur in the future, reinforcing the importance of robust cybersecurity protocols within the energy sector.