Ransomware Hackers Publish Data Stolen in Nova Scotia Power Cyberattack

Nova Scotia Power's headquarters in Halifax on Nov. 29, 2018. The Canadian Press/Andrew Vaughan

Nova Scotia Power has confirmed it was the victim of a sophisticated ransomware attack that began several weeks ago, in which the “threat actor” published stolen data from the utility company’s systems.

“No payment has been made to the threat actor,” Nova Scotia Power said in a May 23 news release. “This decision reflects our careful assessment of applicable sanctions laws and alignment with law enforcement guidance.”

Nova Scotia Power has been working with third-party cybersecurity experts to investigate the incident, which is ongoing, and restore its compromised systems and implement additional security protections, the release says.

Customer information including name, phone number, email address, mailing and services address, utility account information, driver’s licence number, social insurance number, and bank account number may have been compromised in the cyberattack.

“We are actively working with cybersecurity experts to assess the nature and scope of the information that may have been impacted,” Nova Scotia Power says.

Nova Scotia Power and its parent company, Emera Inc., first announced their discovery of the cybersecurity incident on April 25 after noticing “unauthorized” activity on their network.

The companies initiated their incident response “immediately following detection of the external threat” to contain and isolate the affected systems and prevent further attack, Nova Scotia Power said.

The utility company has mailed notifications to impacted customers and will provide them with a two-year subscription to a TransUnion credit monitoring service at no cost.

“We remain sincerely sorry that this issue has occurred,” Nova Scotia Power said. “Protecting the privacy and security of information held by Nova Scotia Power is something we take very seriously.”

Nova Scotians should be cautious of unsolicited communications that appear to be from Nova Scotia Power, including texts, emails, websites, and phone numbers that ask for residents’ personal information, the utility said in a May 23 social media post.

Other Cyberattacks This Year

Several other Canadian institutions have been victims of cyberattacks across the country this year, including a school district in Kingston, Ont., that was attacked on Apr. 16, in which personal information records belonging to staff and students were accessed by hackers.

Personal health information was stolen from a medical centre in Quebec on April 9, while an unauthorized third party accessed an Ontario labour union’s IT system on April 2.

Attacks on municipal governments across the country also occurred this year.

While the sources of these attacks have not yet been determined, Canada’s cybersecurity agency warned regional and local governments about cyberespionage by the Chinese regime in March.

“We have observed repeated targeting of all levels of government, as well as multiple compromises of government networks,” the Centre for Cyber Security said, noting that federal agencies and departments have been compromised by the People’s Republic of China cyber threat actors “more than 20 times over the past few years.”

On April 15, the federal government issued a cybersecurity advisory about the People’s Republic of China targeting network edge routers. It issued another advisory on May 21 about “Russian state-sponsored cyber activity” targeting Western logistics providers and IT companies.

Carolina Avendano contributed to this report.