Full Report
Nova Scotia Power confirms it suffered a data breach after threat actors stole sensitive customer data in a cybersecurity incident discovered last month. [...]
Analysis Summary
# Incident Report: Nova Scotia Power Customer Data Breach
## Executive Summary
Nova Scotia Power (NSP) confirmed a cyberattack involving unauthorized access to parts of their network in March 2025, which was publicly confirmed as a data breach on May 1, 2025. Attackers successfully exfiltrated significant customer data, including names, contact information, dates of birth, and sensitive financial/identity details like Social Insurance Numbers and bank account numbers for some customers. While core utility operations remained unaffected, internal processing was disrupted, and NSP is offering two years of credit monitoring as a remediation step.
## Incident Details
- Discovery Date: Unknown (Confirmed breach on May 1, 2025)
- Incident Date: March 19, 2025 (Actual compromise date)
- Affected Organization: Nova Scotia Power (NSP)
- Sector: Utilities/Energy
- Geography: Nova Scotia, Canada
## Timeline of Events
### Initial Access
- Date/Time: March 19, 2025
- Vector: Exploitation leading to unauthorized access into network and servers. (Specific vector not detailed in source).
- Details: Attackers gained initial unauthorized access into certain parts of NSP's network and supporting servers.
### Lateral Movement
- Details: Attackers moved within the network, leading to the compromise of customer data repositories. The full scope of lateral movement is not detailed, but it was extensive enough to access specific customer records.
### Data Exfiltration/Impact
- Date/Time: Post-March 19, 2025 (Data stolen sometime between the breach date and notification).
- Details: Customer Personal Identifiable Information (PII) and Sensitive Personal Information (SPI) were exfiltrated. This included Full name, Phone number, Email address, Mailing and service addresses, Program participation info, Date of birth, Account history, Driver's license number, Social Insurance Number, and Bank account numbers (for some).
### Detection & Response
- Date/Time: Incident occurred March 19, 2025. Public confirmation of customer data theft occurred on May 1, 2025. Customer notification process began shortly before the report date.
- Details: Incident response efforts caused disruption to internal operations. Affected account holders were being notified via traditional mailed letters, which included information about remediation services.
## Attack Methodology
*Note: The source focuses on the outcome rather than detailed TTPs, so mappings are inferred based on the result (data theft).*
- Initial Access: Exploitation leading to unauthorized access.
- Persistence: Not explicitly stated, but assumed to be established given the gap between compromise (March 19) and public disclosure of theft (May 1).
- Privilege Escalation: Not detailed, but necessary to access customer records containing SINs and banking data.
- Defense Evasion: Not detailed.
- Credential Access: Necessary to access sensitive data stores.
- Discovery: Not detailed, but required network and data reconnaissance.
- Lateral Movement: Successful movement to access customer databases.
- Collection: Gathering of PII/SPI, including DOB, DL#, SIN, and banking details.
- Exfiltration: Transfer of collected customer data off the network.
- Impact: Data loss involving high-value PII and SPI.
## Impact Assessment
- Financial: Not disclosed, however, costs associated with providing two years of credit monitoring for affected individuals will be incurred.
- Data Breach: Extensive theft of PII and SPI, including driver’s license numbers, Social Insurance Numbers (SINs), and bank account numbers for certain customers.
- Operational: Disruption to internal operations occurred due to incident response efforts, though core electricity production and distribution were maintained.
- Reputational: Negative impact due to confirmation of significant customer data theft; required public notifications.
## Indicators of Compromise
- **Network Indicators:** None provided (defanged).
- **File Indicators:** None provided.
- **Behavioral Indicators:** Unauthorized access to internal servers/network zones containing customer PII/SPI.
## Response Actions
- **Containment:** Unauthorized access was addressed, though specific technical steps are not detailed.
- **Eradication:** Efforts were undertaken to remove threat actor presence (implied).
- **Recovery:** Internal operations were restored, though not immediately after the compromise occurred.
- **Remediation:** Provided two-year credit monitoring services via TransUnion to all impacted account holders. Launched customer notification campaign via physical mail.
## Lessons Learned
- A significant gap existed between the initial breach date (March 19) and the date affected customers were informed (around May 1, with mailings following).
- Internal response activities resulted in temporary, but noticeable, disruption to regular business processes.
- The environment contained customer data with high sensitivity (SINs, Bank Details) that was successfully exfiltrated.
## Recommendations
- Review and strengthen network segmentation, specifically isolating critical customer data systems from general network access points.
- Enhance proactive threat hunting and monitoring capabilities to ensure timely detection of unauthorized access and data staging/exfiltration activities, reducing the window between intrusion and discovery.
- Implement multi-factor authentication (MFA) across all critical systems to limit the efficacy of compromised credentials.
- Review and enhance data minimization practices to reduce the amount of high-risk identifiers (like SINs and Bank Details) retained, or ensure they are encrypted at rest and in transit with strong access controls.