Nova Scotia Power Breach Exposed Data of More Than 900,000 Customers

Summary

A breach at Nova Scotia Power exposed data from about 915,000 current and former customers. The article reports a SocGholish infection, data exfiltration and ransomware deployment, followed by regulatory scrutiny and expanded customer protections.

Key points

The article reports that about 375,000 current and 540,000 former customers were affected.
According to details in a compliance letter, an employee visiting a compromised website led to a SocGholish infection around March 19, 2025.
Attackers reportedly escalated privileges, moved laterally and harvested credentials before exfiltrating data from on-premises systems and cloud storage.
Ransomware was deployed and backups were destroyed; employees discovered the incident after reporting system disruptions.
The exposed information reportedly included contact and account details, bank details, driver’s license numbers and Social Insurance Numbers.
The article says there is no confirmed evidence that the data was publicly released or sold; Nova Scotia Power did not pay the ransom.
The company isolated affected systems, reset compromised credentials and extended identity-protection services to five years; the Privacy Commissioner will monitor its security commitments.

Article Details

Victim Organization: Nova Scotia Power
Incident Type: Cyberattack involving a SocGholish infection, credential harvesting, data exfiltration, and ransomware deployment.
Incident Date: 2025-03-19
Disclosure Date: 2025-04-28
Data Types Exposed: Names
Phone numbers
Email addresses
Mailing addresses
Dates of birth
Account and billing history
Bank details
Driver’s license numbers
Social Insurance Numbers
Affected Records: Approximately 375,000 current customers and 540,000 former customers, about 915,000 people in total.
Operational Impact: Multiple applications stopped functioning after ransomware was deployed, and backups were destroyed. Nova Scotia Power isolated affected systems, reset compromised credentials, and worked with cybersecurity experts to investigate and remediate the incident.
Ransom Or Extortion: Ransomware was deployed, and attackers later contacted the company through a Tor-based dark-web page, providing proof that customer data had been accessed. Nova Scotia Power did not pay. The article reports no confirmed evidence that the data was publicly released or sold.
Claim Status: confirmed

People

Philippe DufresneThe Privacy Commissioner of Canada, who publicly welcomed Nova Scotia Power’s commitment to strengthen protections for customer information.

Malware

SocGholishThe attack began with a SocGholish infection from a compromised website, followed by lateral movement, credential harvesting, data exfiltration and ransomware deployment before detection.

Countries

CanadaThe Office of the Privacy Commissioner of Canada received multiple complaints, particularly around delayed notifications and the use of mailed letters, which slowed communication with affected individuals.