Man who died 18 years ago among NS Power customers who were told data was stolen

Many Nova Scotia Power customers are getting confirmation that their personal information was stolen in the cyberattack.

As more Nova Scotians are being told their data was stolen as part of the massive Nova Scotia Power cyberattack back in March, frustration is mounting about how the utility has handled the situation.

“Poorly,” says David Dunn, a chiropractor in Sydney.

“Terribly,” says Carmen Barron, a Guysborough County resident.

“They have failed,” says Kathleen Hains, of North Sydney.

The concern escalated to a new level for Dunn when he checked the mail at his business on Wednesday. He was stunned by what he saw.

“I just saw a letter addressed to my father who passed away over 18 years ago,” Dunn tells CTV News Atlantic. “I was just in shock to see a letter from Nova Scotia Power addressed to my father informing him of the cyber incident and about his personal information.

“It left me uneasy to think, you know, I’m receiving this letter from Nova Scotia Power and I should rest assured, my father should be rest assured, about his information.”

He says his name has been on the clinic’s account since his father’s passing and he receives all the bills.

In a statement to CTV News Atlantic late Thursday evening, Nova Scotia Power apologized.

“We sincerely apologize to the family for this error,” a spokesperson said. “Our teams worked to remove former customers and closed accounts from the database to make sure it was up to date before the letters went out but we acknowledge some may have been missed.”

Concerns from customers

Dunn was certainly not the only person to receive a letter dated Oct. 31.

Carmen Barron, a utility customer for 40 years, wonders what transpired in the months since the attack happened – until learning that her data was stolen.

“I’m like, ‘Oh, my God,’ this is six-and-a-half months later and it was only dated to the 31st, so it’s not like it was lost in the mail,” she says. “I was quite shocked and I thought, ‘Well, maybe they had another breach.’”

Nova Scotia Power said it first found issues with its systems on April 25, but it later learned a “threat actor” had gained unauthorized access to parts of their system on or around March 19. They told customers about the breach in early May.

The utility previously said roughly 277,000 customers were impacted by the breach – which potentially affected information like birth dates and social insurance numbers – but a September report revealed all customers could have been impacted.

Monthly updates have been required to be sent to the Nova Scotia Energy Board.

In response to the most recent update, last week the board said it will refer the matter to MNP to investigate further how the utility handles data.

It also ordered Nova Scotia Power to pay any outstanding bills to vendors or suppliers, provide details about tasks taken to fully recover and share an expected date of when services will be restored.

The whole ordeal has left customers feeling uneasy, including those who previously learned about their information being compromised.

“Very vulnerable,” says Kathleen Hains. “I’m a senior. So, yeah, it’s very concerning. I don’t think they know what they’re doing.”

Utility response

In the statement to CTV News Atlantic, Nova Scotia Power says that as its data analysis investigation nears completion, additional customers continue to receive letters to provide them with information on the incident.

“We’re working diligently to make sure no detail is overlooked and to make sure every affected customer is contacted and given access to free credit monitoring,” the statement reads. “Because of the volume of data impacted and the sophistication of the attack, we’ve been taking every precaution to make sure we are analyzing the impacted data with diligence and extreme care.”

-With files from CTV News Atlantic’s Sean Mott

For more Nova Scotia news, visit our dedicated provincial page