Consumer Advocate and Board Counsel file expert evidence in M12600 cybersecurity inquiry, with 13 recommendations targeting NSPI's privacy, billing, and communications practices

M12600 · Nova Scotia Power - Cybersecurity Accountability IN THE MATTER OF AN INQUIRY about the impact of the cyber incident on NOVA SCOTIA POWER INCORPORATED’s collection and retention of customer information, customer service and communications, billing processes and regulatory matters

AI summary

Consumer Advocate witness Ed Mollard (InterGroup Consultants) filed pre-filed testimony (Exhibit N-13) assessing NSPI's response to the March 2025 cybersecurity incident, covering phishing training failures, data retention of ~540,000 former customers, estimated billing affecting over 50% of accounts from May–November 2025, and incident cost treatment — producing 13 formal recommendations directed at Nova Scotia Power Incorporated.
Mollard found NSPI's phishing failure rate averaged 2.3% (excluding best/worst months) against a 1.5% target, with a peak of 14% in November 2024, and recommended removing the averaging formula and adding computer access restrictions as consequences for repeat failures (Recommendation 1, citing M12600 Exhibit N-6, CA IR-1(a)).
On Customer Service, Mollard recommended NSPI be directed to issue a minimum of 2–3 direct notifications to all customers in future breaches (Recommendation 4), undertake a customer-category-level review of breached data fields (Recommendation 5), and explore options to contact former customers outside the province (Recommendation 6), noting that approximately one million current and former customers had data exfiltrated.
Board Counsel consultant Tricia Ralph (INQ Law/Consulting, Exhibit N-14) concluded that NSPI's personal information inventory practices, SIN collection prior to 2018, notification timeline for former customers (delayed ~two months), contents of customer notices, and retention of data beyond internal schedules were all unreasonable, while finding that the eventual five-year credit monitoring offer, multi-channel communications approach, and regulatory notification were reasonable.
On Billing Procedures, Mollard's Table 8-1 shows estimated bills peaked at 73% of total bills in June 2025 — far exceeding NSPI's 2% performance standard — and recommended prioritized photo meter reads and a more robust contingency billing method (Recommendations 10–11); on incident costs, he recommended NSPI confirm it will not seek rate recovery for breach-related expenses and isolate any insurance premium increases from customer rates (Recommendations 12–13, citing M12600 Exhibit N-6, CA IR-6(b) and CA IR-7(a)).

Disclaimer: This summary was generated by AI from the filings it describes. We take care to make it accurate, but errors are possible - and it isn't advice. Only the filings themselves are the record: if you're relying on something here, confirm it against the source documents or the Nova Scotia Energy Board's own record. Full disclaimer →

What was filed

Documents filed on this day

N-13 Evidence - InterGroup, on behalf of CA - Redacted exhibits
N-13(C) Evidence - InterGroup on behalf of CA - Confidential exhibits
N-14 Evidence & Appendix A Resume - Tricia Ralph INQ Law/Consulting - BCC exhibits
102481 Letter SBA re: Not filing evidence other_documents