NS Power's redacted undertaking responses now available, detailing cyberattack data volumes, Equifax credit-decisioning tool, SIN records gaps, and customer communications scripting

M12600 · Nova Scotia Power - Cybersecurity Accountability IN THE MATTER OF AN INQUIRY about the impact of the cyber incident on NOVA SCOTIA POWER INCORPORATED’s collection and retention of customer information, customer service and communications, billing processes and regulatory matters

AI summary

Exhibit N-24 (U-15) discloses that NS Power's NAS device held approximately 2.5PB of data at the time of the cyberattack, of which the threat actor accessed 7TB — approximately 0.28% of total volume; total IT systems held approximately 3,000TB (U-2).
U-3 and U-11 reveal critical record gaps: NS Power cannot determine how many Social Insurance Numbers were resident in the Data Lake at the time of the attack, as that documentation was itself lost in the incident; approximately 228,000 customers had SINs on record as of July 2021 (transcript p. 152).
U-1 (Attachment 1, Equifax iDecision letter dated Aug 25, 2026) describes three Cybersecurity-by-design credit-check strategies — Consumer Strategy 01 (residential on-bill finance up to $50,000), Consumer Strategy 02 (deposit determination), and Commercial Strategy 01 (business financing) — configured so frontline staff never see raw credit scores or reports, receiving only high-level output codes.
U-9 discloses that suspended collection activities following the cyberattack increased average monthly accounts receivable by ~$65M in 2025 (driving ~$1M additional interest expense) and a forecast ~$101M increase in 2026 (~$3M carrying cost); NS Power states collections and late-payment interest will be reinstated in October 2026, with balances expected to normalize by 2027.
U-12 (Attachment 1, 10-page redacted CSA scripting) and U-17 (Attachment 1, billing inserts June 2025–July 2026) document NS Power's customer-facing communications posture: 5-year free TransUnion myTrueIdentity credit monitoring extended to all current and former customers as of June 25 (activation deadline Sept 30, 2025); advance notice of late-fee reinstatement provided in the July/August 2026 bill insert.

Disclaimer: This summary was generated by AI from the filings it describes. We take care to make it accurate, but errors are possible - and it isn't advice. Only the filings themselves are the record: if you're relying on something here, confirm it against the source documents or the Nova Scotia Energy Board's own record. Full disclaimer →

What was filed

Documents filed on this day

N-24 Undertaking Responses - NS Power - Redacted exhibits
N-24(C) Undertaking Responses - NS Power - Confidential exhibits