Canada’s privacy commissioner says Nova Scotia’s electrical utility has committed to strengthening security and privacy protections in the wake of last year’s cyberattack.
The commissioner last year launched an investigation into the March 2025 cyberattack that saw a hacker gain access to Nova Scotia Power’s systems. Data from approximately 375,000 of its existing customers and approximately 540,000 former customers were affected by the breach, the commissioner said.
In a statement released on Wednesday, Philippe Dufresne says Nova Scotia Power has, through a compliance letter, agreed to implement several measures to protect customers.
The letter includes a commitment that the utility will remove all customer social insurance numbers from its systems by March 31, 2026, and will confirm the deletion to the privacy commissioner. The utility is also committing to an external security assessment to be completed by Oct. 31, 2026.
“I welcome this commitment by Nova Scotia Power to ensure stronger protections for the personal information of its customers,” Dufresne said. “This privacy breach highlights the significant risks of cyberattacks to individuals and companies. Strong, proactive data protection, including robust safeguards, must be prioritized by all organizations in this evolving landscape.”
Nova Scotia Power’s CEO Vivek Sood says the company recognizes the impact of the security breach.
“We’ve learned a great deal from this incident and have taken steps to further enhance our cybersecurity and data governance practices to protect against this kind of criminal activity,” Sood wrote in a statement. “We are committed to implementing all recommendations to protect our customers and our employees.”
Dufresne says his investigation will remain open until he is satisfied all commitments have been fulfilled.