Board Counsel INQ Law/Consulting files responses to four information requests on Nova Scotia Power's personal information management practices following cyber incident in M12600

M12600 · Nova Scotia Power - Cybersecurity Accountability IN THE MATTER OF AN INQUIRY about the impact of the cyber incident on NOVA SCOTIA POWER INCORPORATED’s collection and retention of customer information, customer service and communications, billing processes and regulatory matters

AI summary

Inq Law Consulting responded to IR-1 by citing the NIST Privacy Framework's Inventory and Mapping category (ID.IM-P) as the applicable industry standard for personal information inventories, concluding that Nova Scotia Power Incorporated's admission that it "does not know and will never know what data points for each individual impacted customer were exposed" indicates its PI Inventory was deficient or not operationalized (Report para. 13, p. 6).
On IR-2, INQ Law/Consulting confirmed that periodic audits of internal access to personal information reflect the NIST PR.AC-P4 least-privilege principle, but noted the lack of such audits in the two years before the incident was not likely a contributing factor since the breach originated from an external cyberattack (Report para. 31, p. 9).
Responding to IR-3 on the adequacy of Customer Service remediation, INQ Law/Consulting concluded that five years of credit monitoring is reasonable where Cybersecurity incidents compromise Social Insurance Numbers, citing Saskatchewan IPC Investigation Report 370-2021, the 2025 Nova Scotia OIPC Report IR25-01, and noting the Saskatchewan Commissioner has since escalated its recommendation to ten years (Report para. 89, p. 21).
On IR-4, INQ Law/Consulting identified the two most significant failures relative to customer expectations as: (1) collection of SINs when not required for legislated purposes; and (2) NSPI's inability to identify exact compromised data points; and identified excessive data retention as the most significant failure in limiting attack impact (Report para. 106, p. 26).
In a separate filing, Nova Scotia Power Incorporated requested that its witness Jena Valdetero of Greenberg Traurig LLP appear virtually at the upcoming hearing.

Disclaimer: This summary was generated by AI from the filings it describes. We take care to make it accurate, but errors are possible - and it isn't advice. Only the filings themselves are the record: if you're relying on something here, confirm it against the source documents or the Nova Scotia Energy Board's own record. Full disclaimer →

What was filed

Documents filed on this day

N-15 INQ Law/Consulting (CA) RIRs 1-4 exhibits
102999 Letter from NSPI requesting virtual appearance of witness other_documents