N-1LOCs Redacted (N-1 from M12273)
9 passages
That, in itself is a major breach of trust, during an ongoing security breach. Even now, NS Power will not provide the basic NS Power profile information to a customer calling in and requesting same. I was born in this province and have li...
AI summary The letter highlights a breach of trust by NS Power due to a security breach and failure to inform customers promptly. It criticizes NS Power for poor infrastructure maintenance, frequent power outages, and excessive rate increases, leading to financial hardship for Nova Scotians. The writer questions the government's response to these issues.
\ \ EXTERNAL EMAIL / COURRIEL EXTERNE \ \ Exercise caution when opening attachments or clicking on links / Faites preuve de prudence si vous ouvrez une pièce jointe ou cliquez sur un lien Hi Ms. Henwood, I hope that all is well. I received...
AI summary The email discusses a customer's concerns regarding unauthorized access to their personal information by Nova Scotia Power (NSP) and the inadequate response from NSP and Transunion. The customer faced difficulties in contacting NSP directly and experienced poor service when attempting to reach out through Transunion.
Re: Important Notice About Your Personal Information Dear Valued Customer: We are writing to provide you with information about the recent cyber incident impacting Nova Scotia Power. On April 25, 2025, Nova Scotia Power discovered that an...
AI summary Nova Scotia Power has informed customers of a cyber incident where unauthorized access occurred on March 19, 2025, leading to the potential exposure of personal information. The company has engaged cybersecurity experts and notified authorities. As a precaution, customers are being offered free credit monitoring through TransUnion.
e Resolution Officer From: Sean Kelly Sent: May 26, 2025 7:19 PM To: [email protected] Subject: Data Breech I am writing on behalf of myself and my wife Michelle Kelly. We live at Nova Scotia. We have received a letter from NS...
AI summary Sean Kelly and his wife Michelle Kelly are reporting a data breach by Nova Scotia Power, expressing dissatisfaction with the lack of notification, inadequate security, and insufficient compensation. They seek fair compensation based on previous settlements and reject the 2-year credit coverage as a resolution.
2. Lack of Transparency The notification provided very little detail. It failed to clearly state what information was accessed, how the breach occurred, and whether our data has been used maliciously. We are left unsure of what steps to ta...
AI summary The text highlights concerns about transparency, support, and data retention practices following a data breach. The customer expresses dissatisfaction with the lack of detailed information provided about the breach, the inadequacy of the support offered, and questions about the retention of sensitive data. The customer also requests a meter inspection and billing review due to unusually high bills.
I am formally requesting: - 1. A full explanation of how this breach occurred and what data of mine was compromised. - 2. Immediate restoration of billing communication in a secure format. - 3. Written confirmation that my credit and accou...
AI summary The complainant, Elizabeth Hartling, is requesting a full explanation of a data breach, restoration of secure billing communication, assurance of no negative impact on her credit or account status, an apology for poor customer service, and financial compensation for stress and potential identity theft. She threatens to escalate the matter to the Nova Scotia Utility and Review Board and other relevant bodies if not resolved within 14 days.
Danielle Kristine Maillet NSPower Account #: To: NS Power Customer Service CC: Privacy Office, Billing Department, Legal Department Re: Data Breach, Billing Disruption, and Compensation Demand Dear NS Power, I am writing to formally expres...
AI summary Danielle Kristine Maillet is writing to NS Power to express concerns about a data breach and billing disruptions, demanding a full waiver of her current bill, a credit for an unsolicited service, and a freeze on future charges until online access is restored. She threatens to escalate the matter to regulatory bodies and seek legal consultation if unresolved.
As of the date of this letter, I have waited 121 days to have NSP identify to me what information of mine was taken. My original question remains: why should I pay my power bill? NSP appears unwilling, or unable, to reveal what data of min...
AI summary The complainant has waited 121 days for NSP to disclose what personal information was taken, expressing frustration over the lack of transparency regarding data theft and the inability to understand why they should pay their power bill. They feel their data is being held hostage by both cyber criminals and NSP.
Type of complaint: Other Additional details: I was notified that my personal information was compromised in the spring 2025 data breach and was sent a link for identity theft protection. Not only did this link not work, but even after nume...
AI summary A customer reported a data breach in spring 2025 and was sent a non-functional link for identity theft protection by NSP. The customer expressed frustration with NSP's registration system and requested credit protection registration and compensation for the stress and time wasted.
N-2NSPI (NSEB) RIR 1 to 12 - Redacted (N-2 from M12273)
6 passages
NS Power – Cyber Incident Updates (Website Excerpts – September 5, 2025) - Informed impacted customers via mail and provided a free subscription to TransUnion's credit monitoring service, my TrueIdentity®. - Organized in-person support for...
AI summary NS Power has informed impacted customers via mail and provided free credit monitoring services. They have also organized in-person support and resumed billing through an estimated billing approach with access via MyAccount.
What are you doing to reach former customers who no longer live in the province to provide the credit monitoring? Last updated: Wednesday, June 25, 2025 Former customers for whom we have contact information will be sent a written notificat...
AI summary Nova Scotia Power (NSP) is taking steps to notify former customers who no longer live in the province about credit monitoring services. They are using media, social platforms, and advertising to reach those without contact information and encourage sign-ups for the free five-year service.
What services have been affected? Last updated: Tuesday, June 24, 2025 Initially, there was disruption to our internal IT and customer care systems, which affected our billing processes and access to our online customer portal, MyAccount....
AI summary The disruption affected internal IT and customer care systems, leading to issues with billing processes and access to the online customer portal, MyAccount. Services like MyEnergy Insights and Efficiency Insights are currently unavailable through MyAccount.
Board Inquiry into Nova Scotia Power's Cybersecurity Incident (NSEB M12273) NSPI Responses to NSEB Information Requests 1 Request IR-2: 30 identity protection service, and TransUnion has extensive experience providing customer 1 notificati...
AI summary The document outlines the credit monitoring service provided to customers affected by a cybersecurity incident at Nova Scotia Power. The service includes credit reports, credit scores, monitoring alerts, educational resources, and access to identity restoration agents.
5 6 7 8 9 10 11 12 13 14 (h) On June 25, 2025, NS Power announced that it was extending its offering to five years of 15 complimentary credit monitoring and other services under the TransUnion 16 myTrueIdentity® offering, and made the serv...
AI summary NS Power extended its complimentary credit monitoring service from two to five years, offering it to all past and current customers. This decision was made in response to customer feedback, aiming to provide greater reassurance and protection following data breaches.
NON-CONFIDENTIAL 1 While signing up online remains the best path for most customers, this in-person support 2 was intended to help those who are less comfortable with the online process or have 3 questions. Date Filed: September 5, 2025 NS...
AI summary The text discusses in-person support for customers who may be less comfortable with online processes or have questions, emphasizing that online signing remains the preferred method for most.
N-3Incident Report - Redacted (N-3 from M12273)
4 passages
1 3.2 Data & Personal Information 2 3 The process to 4 identify the customers who were directly impacted has been extremely complex, and has been 5 completed. As set out in the notices sent to impacted customers, the impacted data would ha...
AI summary The process to identify customers directly impacted by a data breach has been completed. The breach involved access to personal information such as names, contact details, account history, and SINs. The Company issued two versions of notification letters to affected customers, varying slightly in the information provided about the breach.
2025 Nova Scotia Power's Cybersecurity Incident Report REDACTED 1 escalated queries, this call centre was staffed by TransUnion employees who had been provided 2 with prepared responses from NS Power, and instructed to escalate any queries...
AI summary NSP collaborated with TransUnion to manage customer inquiries regarding a cybersecurity incident, providing call-back services and in-person support. Community engagement and updated resources on the NSP website were implemented to assist customers with credit monitoring and identity theft prevention.
4 Customer Support for Bills 5 6 NS Power acknowledges and understands customer concerns with the estimated billing process. 7 8 When billing resumed in June, NS Power created a dedicated webpage at nspower.ca/billing to 9 outline the bill...
AI summary NS Power acknowledges customer concerns with estimated billing and has taken steps to improve communication, including a dedicated webpage, bill inserts, and in-person community sessions. The company also plans to continue revising bill inserts and holds sessions to address customer questions.
NS Power Cyber Incident Report Appendix B Page 1 of 7 Affected Regulatory Matters Report 2 - October 1 Report 3 - November 3 Report 4 - December 1 Latest update Forecast Restoration of Normal Activities Customer Energy Management (CEM) Eva...
AI summary The document outlines the impact of a cyber incident on the Customer Energy Management (CEM) Evaluation, Measurement, and Verification (EM&V) process. Due to data limitations, the My Energy Insights (MEI) platform is unavailable, and NS Power is consulting with Econoler to develop an alternative approach for 2025 CEM EM&V, which will be submitted to the NSEB for consideration.
N-4NSPI (NSEB) RIR 13 to 15 (N-4 from M12273)
3 passages
(g) Interest is not paid on utility payments above actual usage charges. This is consistent with the approach taken with equal billing arrangements where credits are provided. Where true reads do result in a credit on the account, there is...
AI summary The text discusses the handling of utility payments above actual usage charges, noting that interest is not paid on such payments and that customers can request refunds for credits. It also mentions the impact of a cyber incident on billing practices and the introduction of an online form for photo meter readings. A quote from Mr. Lanteigne regarding billing trends in November 2025 is included.
Request IR-16: Since becoming aware of the cyber incident, has NS Power deployed additional resources specifically to assist with the estimated billing process, including responses to customer complaints about estimated bills? Response IR-...
AI summary NS Power has deployed additional resources, including new hires and temporary meter reading staff, to assist with the estimated billing process and manage customer complaints following a cyber incident. They have also leveraged external contact centres and internal employees to handle increased call volumes and provide support to customers.
NON-CONFIDENTIAL Finally, employees in Customer Care and Billing, like many areas across NS Power, have worked extra hours to demonstrate their commitment to supporting customers since the cyber incident. Date Filed: December 23, 2025 NSPI...
AI summary NS Power employees in Customer Care and Billing have worked extra hours to support customers following a cyber incident, demonstrating commitment to service continuity. The document references a filing dated December 23, 2025, related to matter IR-16.
N-6NSPI (CA) RIR 1-11 - Redacted
3 passages
Minister of Energy – Accountability for Nova Scotia Power (NSEB M12600) NSPI Responses to Consumer Advocate Information Requests 1 Request IR-5: 2 3 Customer Account Collections 4 5 Reference: Exhibit 100853 - NS Power's Monthly Update #2,...
AI summary In response to a request regarding customer account collections, NSPI explains that late fees have been waived and collections paused since the incident. They emphasize working with customers to manage outstanding balances and avoid disconnection, highlighting a customer-centric approach.
NON-CONFIDENTIAL 1 (b) As noted in response to CA IR-8, NS Power adopted an approach to mitigating harm to 2 customers that adhered to, and in many cases exceeded, the standard recommended 3 measures that organizations across all industrie...
AI summary NS Power outlines measures to mitigate customer harm post-cybersecurity incident, including no late fees, no disconnections for non-payment, and offering interest-free payment plans. These actions align with industry standards and aim to reduce financial and service impacts on customers.
CONFIDENTIAL (Attachmen Only) 1 Request IR-10: 2 3 Customer Impacts 4 5 Question 6 7 (a) For each month following the Incident up to and including the most recent month of 8 actuals available, please provide: 9 10 (i) The total number and...
AI summary The document outlines a request (IR-10) to Nova Scotia Power Inc. (NSPI) regarding customer impacts from a cyber incident, including metrics on estimated bills, complaint resolution, service quality, and changes to billing methods. It also seeks policies and procedures related to handling customer complaints and potential method updates post-incident.
N-10NSPI (NSEB) RIRs 1-25 - Redacted
8 passages
1 ccount Nur nber Amo unt due Jun 05 i $400 .24 Rates April per month Nov 23 1300 58 24. 1 2 (c) The CIS estimation subroutine was part of the original product implementation in 1997. 3 Any changes require custom development by a third-par...
AI summary The text discusses the CIS estimation subroutine, implemented in 1997, which uses historical data to estimate bills when meter readings are unavailable. It highlights that the subroutine is not trainable or capable of machine learning. The document also includes a request about how the subroutine works for customers with net-metering.
Minister of Energy – Accountability for Nova Scotia Power (NSEB M12600) NSPI Responses to NSEB Information Requests 1 (ii) Customers can call into NS Power and receive information on both their 2 consumption and generation on their meter f...
AI summary The document discusses a cyber incident affecting NS Power's ability to provide accurate data on net metering participants. The information provided in the 2025 Annual Report may change in the 2026 Report once data recovery is complete and any changes are confirmed.
What we collect and why: The type of personal information which we collect and maintain includes: - Name - Premise Address and Mailing Address - Email address - Telephone number - Identifying information such as your date of birth and info...
AI summary Nova Scotia Power collects personal information such as names, addresses, contact details, banking information, and energy consumption data. Smart meter data is used to improve service and provide energy insights. This includes details on power consumption patterns and participation in energy programs.
Sharing your information We do not sell or rent our customers' personal information. We do, however, disclose personal information to certain third parties in accordance with the purposes listed above. These third parties may provide us wi...
AI summary The document outlines how customer personal information is shared with third parties for services like billing, data processing, and efficiency programs. It also notes that information may be processed in foreign countries and that linked websites have different privacy policies.
Correcting and retaining your information Please feel free to contact us at any time to update your personal information. The length of time we keep your information varies depending on the product or service in question and the nature of...
AI summary The document outlines the process for correcting and retaining personal information, stating that the duration of retention depends on the product or service and the nature of the information. Information is kept to meet customer service, legal, and regulatory needs and is destroyed or anonymized when no longer required.
Your Privacy Choices Subject to certain legal and contractual restrictions and reasonable notice, you can choose to refuse or withdraw your consent to the collection, use or disclosure of your personal information at any time. For example,...
AI summary The document outlines consumer rights regarding personal information, including the ability to withdraw consent for data collection, use, or disclosure, and highlights potential limitations in accessing certain products or services if consent is withdrawn.
NON-CONFIDENTIAL 1 Please refer to the Nova Scotia Power website (www.nspower.ca) for ongoing updates. 2 3 32. I am moving homes and need to ensure I have a power connection/I am planning to do 4 some work near a power line/other service r...
AI summary The text outlines customer inquiries and responses from Nova Scotia Power regarding service-related requests, system restoration efforts following a cybersecurity incident, and the security of their network. It emphasizes ongoing updates and collaboration with cybersecurity experts.
Request IR-16: Please provide any memos, assessments, reports or email messages prepared by NS Power or on its behalf about the difficulties that customers experienced contacting NS Power's Customer Care Centre and TransUnion in the days f...
AI summary The response to Request IR-16 outlines the establishment of a dedicated cyber support line by NS Power and TransUnion following a cybersecurity breach and theft of customer information. It mentions the dates when these support lines were set up and notes that call statistics are provided for the requested period.
N-13Evidence - InterGroup, on behalf of CA - Redacted
10 passages
In the Matter of EVIDENCE OF ED MOLLARD M12600 JUNE 23, 2026 Nova Scotia Power Incorporated (NSPI) AN INQUIRY ABOUT THE IMPACT OF THE CYBER INCIDENT ON NSPI'S COLLECTION AND RETENTION OF CUSTOMER INFORMATION, CUSTOMER SERVICE AND COMMUNICA...
AI summary This document is pre-filed testimony from Ed Mollard on behalf of the Consumer Advocate regarding the impact of a cyber incident on NSPI's customer information management, customer service, billing processes, and regulatory matters. The testimony was submitted to the Nova Scotia Energy Board.
2.0 SUMMARY OF RECOMMENDATIONS Based on the analysis summarized in this report, InterGroup makes the following recommendations to the Board: - Recommendation 1: InterGroup recommends NSPI be directed to update its staff training policies a...
AI summary InterGroup recommends several measures to NSP and NSPI, including updating staff training policies, enhancing privacy practices, conducting compliance audits, improving customer notifications, and managing credit monitoring services. These recommendations aim to improve cybersecurity, privacy, and customer communication following a data breach incident.
ort, Section 3.1, Pg 12. 4 M12273, Exhibit N-5 Refiled Incident Report, Section 3.2, Pg 14. 5 M12273, Exhibit N-5 Refiled Incident Report, Section 4. The Nova Scotia Energy Board initiated a proceeding to review the incident and NSP's resp...
AI summary The Nova Scotia Energy Board initiated a proceeding (M12273) to review an incident and NSP's response. NSP was required to submit an incident report by December 31, 2025. A separate proceeding (M12600) was created to investigate customer-service related issues arising from the 2025 NSP Cybersecurity incident, including privacy policies, billing accuracy, and communications with customers.
6.1 TIMING OF INCIDENT DETECTION AND INITIAL CUSTOMER NOTIFICATION NS Power discovered the incident on April 25, 2025, over a month after the breach first occurred (March 19, 2025) and subsequently issued a public notice on April 28, 2025....
AI summary NS Power discovered a cybersecurity breach on April 25, 2025, over a month after it occurred on March 19, 2025, and issued a public notice 39 days later. This delay led to customer trust loss, complaints, and service disruptions. NS Power attributes the delay to limitations in its security detection systems. The NSEB is reviewing cybersecurity improvements as part of Proceeding M12273.
6.2 FREQUENCY OF COMMUNICATIONS TO CURRENT CUSTOMERS NSP issued only one direct notice to current customers (sent on May 13, 2025 to initially identified 277,000 customers[50](#page-16-5) and October 31, 2025 to 97,000 additional customers...
AI summary NSP issued direct notices to customers affected by a data breach, but delays in notification were criticized. Customers were not informed until May 23, 2025, two months after the breach. A survey showed that direct notifications were the most effective method, but some argued that more frequent updates would have been better.
6.3 COMMUNICATION TO FORMER CUSTOMERS NS Power determined that personal information of former customers was also impacted by the breach and provided a public notification on June 25, 2025.[59](#page-18-1) With respect to communication to i...
AI summary NS Power notified the public about a data breach affecting former customers but did not directly contact them due to lack of updated contact information. A recommendation is made for NSP to explore ways to reach former customers who may have relocated outside the province.
7.0 CREDIT MONITORING According to the Incident report,[65](#page-19-1) NS Power adopted a best-practices approach to mitigate potential harm to customers arising from the Incident. An initial two years complimentary credit monitoring syst...
AI summary NS Power implemented a credit monitoring and identity protection service for impacted customers following an incident, offering complimentary coverage for five years. Customers have raised concerns about the mitigation strategies employed.
8.0 FINANCIAL IMPACTS ON CUSTOMERS As a result of the breach, several customer care systems and processes were disrupted, resulting in significant impacts to billing processes, AMI readings, and access to the online customer portal. NSP no...
AI summary The breach caused disruptions in customer care systems, affecting billing processes, AMI readings, and online access. NSP paused billing temporarily and used estimated bills based on seasonal usage, leading to customer complaints about overbilling.
In response to the 2026-2027 GRA compliance filing information requests,[78](#page-22-3) NS Power confirmed that its meter reading and billing processes have been restored to its pre-incident state. NSP notes its billing estimation is now...
AI summary NS Power has confirmed that its meter reading and billing processes have been restored to their pre-incident state, with billing estimation performing within the performance standard. However, customers have reported difficulties in contacting the customer care team, leading to a significant number of abandoned billing-related calls, especially during the incident response period.
Table 8-2: NSP's Statistics on billing-related calls as of April 23, 2026 [82](#page-23-1) Month Customer Billing- Related Calls Calls Answered % Answered within 30 seconds Average Speed of Answer Calls Abandoned Average Call Length May-25...
AI summary The table presents statistics on NSP's billing-related calls from May 2025 to April 2026, showing trends in call volume, answered calls, and call handling metrics. NSP waived late fees and paused collections for active customers and used manual meter reading to gather accurate usage data for billing purposes.
N-14Evidence & Appendix A Resume - Tricia Ralph INQ Law/Consulting - BCC
6 passages
- 1. In my opinion, the following met best practice, and were reasonable in terms of expectations for customer service and limiting the impacts of the cybersecurity attack on customers: - Aside from issues related to the personal informati...
AI summary The text evaluates Nova Scotia Power Incorporated's (NSPI) response to a cybersecurity attack, finding some actions reasonable and others unreasonable. Key points include the reasonableness of customer notification timelines and communication efforts, while the use of a PI inventory, retention of SINs, and insufficient customer notices were deemed unreasonable.
Former Customer Notification 45. Section 4.2 of the Incident Report states that as it continued its investigation, NSPI determined that PI relating to former customers had also been impacted by the Incident. The Incident Report does not sp...
AI summary The Incident Report indicates that NSPI identified former customer data was impacted by the Incident, but did not notify them until two months after the Incident was discovered. The delay is considered unreasonable, as best practices suggest notification should occur within days, not months, unless extenuating circumstances apply, which were not indicated here.
Contents of Direct Customer Notification 49. In Section 3.2 of the Incident Report, NSPI explained that, with respect to direct notifications, it issued two versions of notification letters to impacted customers. The letters were substanti...
AI summary NSPI issued two versions of direct customer notification letters following an incident, with one version informing customers that their social insurance numbers may have been affected.
- NS Power program participation information: As background, NS Power offers its customers certain programs such as the MyEnergy Insights, HEAT Fund, or Critical Customer Communication Program. The impacted information related to these pro...
AI summary The document outlines the types of personal information collected by NS Power through its programs and customer accounts, including power consumption data, service requests, payment and billing history, and customer correspondence. It also references NSPI's Customer Privacy Policy, which states that only necessary personal information is collected.
nion sign-up process, NSPI deployed dozens of employees to communities across the province to provide hands-on support for customers who prefer assistance in person, recognizing that not all customers may be comfortable registering online,...
AI summary NSPI deployed employees to assist customers in person with credit monitoring sign-ups, recognizing not all customers are comfortable registering online. Over 700 customers were assisted, and additional resources were made available through the website, fact sheets, and community sessions to help customers protect themselves from identity theft.
F. Conclusion - 105. In conclusion, in my opinion, the following actions by NSPI met best practice, and were reasonable in terms of expectations for customer service and limiting the impacts of the cybersecurity attack on customers: - Asid...
AI summary The conclusion evaluates NSPI's actions following a cybersecurity attack, finding some measures reasonable and others not. While NSPI's privacy governance, notification timelines, and customer communication were deemed reasonable, the use of a PI inventory, retention of SINs, and lack of record-keeping were considered unreasonable.
N-16NSPI Refiled Formal Incident Report - Redacted (filed in M12273 as N-5 on April 27, 2026)
6 passages
1 3.2 Data & Personal Information 2 3 . The process to 4 identify the customers who were directly impacted has been extremely complex, and has been 5 completed. As set out in the notices sent to impacted customers, the impacted data would...
AI summary The document discusses the complexity of identifying customers impacted by a data breach involving NS Power. It outlines the types of personal information accessed, including names, contact details, account history, and sensitive identifiers like SIN and bank account numbers. Two versions of notification letters were issued depending on whether a customer's SIN was affected.
- 28 NS Power will continue to revise bill insert content to reflect the current customer experience and
AI summary NS Power will continue revising bill insert content to reflect the current customer experience.
REDACTED 1 The Company also initiated proactive outreach to local radio stations across the province 2 to advise customers of this work and avoid any confusion or concern about meter readers 3 entering their properties to read meters. Belo...
AI summary The Company conducted outreach to local radio stations across Nova Scotia to inform customers about meter reading activities and prevent confusion or concern. A 60 percent response rate was achieved from the contacted stations.
Further Protection Here's are some additional steps you can take to further protect your personal information: Service Canada advises individuals affected by a breach to contact both TransUnion and Equifax for file monitoring and to regula...
AI summary The text outlines steps individuals can take to protect their personal information following a data breach, including contacting credit agencies, monitoring financial statements, and enrolling in fraud alerts and security freezes.
NS Power – Cyber Incident Updates (Website Excerpts – September 5, 2025) - x Those who want to sign up for the credit monitoring service can use our Customer Verification Form to validate and secure a unique code for the service. - x Custo...
AI summary NS Power is offering a credit monitoring service to affected customers following a cyber incident. Customers can access the service using a Customer Verification Form and will not be charged for any related costs. NS Power remains available for regular business during standard hours.
What are you doing to reach former customers who no longer live in the province to provide the credit monitoring? Last updated: Wednesday, June 25, 2025 Former customers for whom we have contact information will be sent a written notificat...
AI summary Nova Scotia Power is notifying former customers who no longer live in the province about credit monitoring services. They are using media, social platforms, and advertising to reach those without contact information. They encourage sign-ups for free credit monitoring and sharing information with former customers.
N-17NS Power Rebuttal Evidence - Redacted
9 passages
Cybersecurity Accountability REDACTED CBC CB – Info Morning – Sydney - [[email protected];](mailto:[email protected]) with an offer to interview our Director of Customer Care Springhill, Cumberland County – Thursday, July 3, 20...
AI summary NS Power responded to media inquiries regarding customer bills and meter readers being hired to manually read meters across Nova Scotia. The company engaged with various media outlets and proactively reached out to local radio stations to inform customers about this activity and prevent confusion.
15 (b) Current Customer Notification Speed Does Not Establish What Was Feasible for 16 Former Customers 17 Based on the information in the record and information obtained from individuals directly involved 18 in the Incident response, NS P...
AI summary NS Power quickly notified current customers of a data breach by using existing customer data, but faced challenges in notifying former customers due to the lack of current contact information, which is common given the transient nature of the customer base and the presence of universities in Nova Scotia.
9 Expert Opinion - 10 I disagree with this finding. The elapsed time between the May 13 notification and the October 31 - 11 notification requires contextual analysis that Ms. Ralph's approach does not fully or otherwise - 12 sufficiently...
AI summary The expert disagrees with the finding regarding the timing of NS Power's customer notifications, arguing that the October 31 direct mailing was a reasonable follow-up after initial public communications and ongoing forensic analysis, rather than the first notification to affected individuals.
12 Expert Opinion - 13 I disagree with this finding. Customers were sent two different types of notifications: those where - 14 SINs were collected and therefore could have been affected in the Incident and those whose SINs - 15 were not c...
AI summary The expert disagrees with a finding regarding customer notifications following a data incident, arguing that the letter provided clear guidance consistent with industry standards. The use of a TransUnion call center is noted as a common practice, and any credit monitoring issues were addressed.
3 (b) Telling Customers to Assume All Data Was Accessed Would Have Created Its Own 4 Risks 5 Ms. Ralph suggests at paragraph 55 that a more cautious approach would have been to advise 6 customers to assume that all data points had been acc...
AI summary Ms. Ralph suggests advising customers to assume all data was accessed, but this approach could cause unnecessary alarm and costly actions. NS Power's approach of informing customers about the largest scope of potentially affected data while acknowledging variation by customer is considered accurate and defensible.
3 (d) NS Power Deployed Unusually Robust Supplemental Support - 4 The record establishes that NS Power deployed a comprehensive support infrastructure alongside - 5 the community outreach, which materially addressed any informational limit...
AI summary NS Power implemented extensive measures to support customers affected by a data incident, including a dedicated call center, outreach efforts, media campaigns, and in-person community sessions. These actions were deemed unusually robust and aimed at addressing informational gaps and assisting customers with credit monitoring enrollment.
6 (e) Use of TransUnion for Call Center Support Was Operationally Appropriate - 7 Ms. Ralph notes at paragraph 52 of the Ralph Report that customers who called the dedicated - number were directed to TransUnion rather than NS Power.[8](#pa...
AI summary The use of TransUnion for call center support during a breach was deemed operationally appropriate due to the high volume of calls and the need for specialized breach response representatives. NS Power handled escalated queries internally, and the arrangement was consistent with standard breach response practices.
25 (c) Over-Notification May Cause Confusion and Unnecessary Alarm - 26 Sending notices to customers to tell them they have not been affected by an incident sharply - 27 departs from industry practice. In my experience, where an organizati...
AI summary The text discusses the potential negative impact of over-notifying customers about incidents, suggesting that informing them they were not affected may cause confusion and unnecessary alarm, deviating from industry practices.
8 (c) Customer-Selected Alternatives Would Create Unnecessary and Uncertain Costs - 9 The value of the TransUnion myTrueIdentity service offered through NS Power's mass-enrollment - 10 breach response engagement may differ from the retail...
AI summary The text argues that customer-selected alternatives, such as the TransUnion myTrueIdentity service, may lead to unnecessary and uncertain costs. It highlights concerns about potential costs exceeding reasonable caps and the lack of clarity on reimbursement and dispute resolution.
N-24Undertaking Responses - NS Power - Redacted
17 passages
Strict Protections for Consumer Privacy and Personal Information A foundational benefit of NSP's iDecision integration is its rigorous, system-enforced protection of customer data. The platform completely eliminates manual oversight and su...
AI summary NSP's iDecision integration ensures customer data privacy by masking credit reports and scores, displaying only high-level operational codes, and using fraud detection tools like SafeScan to protect consumer privacy during credit checks and service actions.
\ \ \ June 25th update as per public announcement\ \ \ Beginning June 25th, we will be offering 5 years of free credit monitoring to ALL customers, past and present, regardless of whether they received a letter about the incident. For any...
AI summary Nova Scotia Power is offering 5 years of free credit monitoring to all customers, past and present, as part of a public announcement made on June 25th. This offer includes automatic extension for those who already signed up, and customers will not be charged for any costs related to credit monitoring resulting from this incident.
General Guidance - As always, we can demonstrate that we care for our customers by showing empathy and support at this time. - Our website nspower.ca is the best single source for cyber incident updates and customer support. - We encourage...
AI summary Nova Scotia Power Inc. (NSPI) provides guidance to customers affected by a cyber incident, offering free credit monitoring through TransUnion and directing them to resources for identity theft protection. Customers are encouraged to redeem activation codes before a specified deadline.
Q: Why didn't you offer credit monitoring to everyone right away when this happened? Why now? Our initial focus was on customers that our investigation confirmed that their personal data was were impacted by the breach. Through our investi...
AI summary The company initially focused on customers confirmed to have been impacted by a data breach but is now expanding free credit monitoring to all customers, past and present, due to concerns about the breach affecting former customers' personal data.
Q: Why wasn't 5- years of credit monitoring offered from the start? Is it because your insurance will only cover 2 years? We've heard from our customers and know they are concerned about the safety of their personal information. We listene...
AI summary The company acknowledges customer concerns about personal information safety and has decided to offer five years of credit monitoring coverage to all Nova Scotia Power customers, both past and present, in response to feedback.
Q: What are you doing to reach former customers who no longer live in the province to provide the credit monitoring? Given that we do not have updated contact information for many of our former customers, and given that we are still workin...
AI summary The organization is addressing the challenge of reaching former customers who no longer reside in the province for credit monitoring by using media, social platforms, stakeholder engagement, and paid advertising. They also encourage sign-ups for free credit monitoring services.
Q: Was my data impacted? all current and former customers Anyone who received a letter from us did receive information about what personal data may have been impacted in that letter. Our investigation remains ongoing. The ransomware attack...
AI summary Nova Scotia Power Inc. is investigating the impact of a ransomware attack on customer data. They sent letters to affected customers and are offering free credit monitoring to all current and former customers. The investigation is ongoing, and specifics about data impact are not yet confirmed.
Q: I didn't get a letter and I am a Nova Scotia Power customer or former customer. How do I get an activation code to sign up for credit monitoring? To receive your unique activation code that will enable you to sign up for credit monitori...
AI summary A customer or former customer of Nova Scotia Power who did not receive a letter can obtain an activation code for credit monitoring by visiting the NSP website and completing a verification process with the primary account holder's personal information.
Q: Why do you keep SINs in your database? SINs were used in certain circumstances for customer authentication purposes. We are committed to permanently deleting all instances of SINs from our systems as soon as our investigation allows. Ou...
AI summary The organization uses SINs for customer authentication but plans to permanently delete them once the investigation permits. Customers are advised to use the free 5-year credit monitoring service for security.
Q: If a spouse is also listed on the account, has their information been compromised too? And if so, will they receive a letter and credit monitoring services? Notifications have been mailed to impacted individuals, which include detailed...
AI summary The document discusses whether a spouse listed on an account would also receive notifications and credit monitoring services following a data compromise. It confirms that notifications have been sent to impacted individuals and mentions the availability of TransUnion credit monitoring services.
Q: Why can't you sign everyone up for TransUnion, why is the onus on the customer? Consistent with industry practice, TransUnion requires individuals to complete their own enrollment for the credit monitoring services. TransUnion will enga...
AI summary The entity explains that TransUnion requires individuals to enroll themselves in credit monitoring services, aligning with industry practices. They will directly engage with affected account holders to ensure enrollment at no cost.
Q: When will your customer service systems be fully restored? We continue to work to restore our systems safely and securely. Currently, we are not able to provide a timeline for full restoration. The latest information is posted on our we...
AI summary Nova Scotia Power Inc. (NSPI) is working to restore customer service systems safely and securely but cannot provide a timeline for full restoration. The latest updates are available on their website.
June 2025 Bill Insert (Estimated Bills) A webpage dedicated to the latest information on the post cyber billing experience was launched and promoted to customers. NSPOWER.CA/BILLING is the single source of truth. This website was also feat...
AI summary A new webpage, NSPOWER.CA/BILLING, was launched to provide customers with the latest information on the post-cyber billing experience. The website serves as the single source of truth and was promoted through corner ad messages on all bills.
November/December 2025 Bill Insert Continued awareness of the need to estimate customer usage. Focus moves to the post meter read experience including adjustments that will appear on the next bill. NSPOWER.CA/BILLING is expanded with video...
AI summary The November/December 2025 Bill Insert highlights efforts to improve customer awareness of electricity usage, focusing on post-meter-read adjustments and expanded online resources. It also notes the start of annual seasonal awareness campaigns about temperature changes and their impact on electricity consumption.
To our customers. We know that over the past year, you have had a lot of questions about the cyber incident and the impacts on our billing systems. For over a century, Nova Scotia Power has been a part of this province. Our team of 2,200 e...
AI summary Nova Scotia Power acknowledges customer concerns regarding a recent cyber incident affecting billing systems. The company emphasizes its long-standing commitment to the province and its dedication to providing essential services and earning customer trust.
Flexible Payment Options Our team can provide interest-free payment plans or enroll you in Equal Billing to help manage monthly costs. If you need assistance, please call us at 1-800-428-6230.
AI summary The document outlines flexible payment options for customers, including interest-free payment plans and enrollment in Equal Billing to assist with managing monthly costs. Contact information is provided for further assistance.
July/August 2026 Bill Insert Provided the advance notice we committed to – and making sure customers are aware of the interest-free payment plans that are available to them to avoid being impacted by the return of late fees October 1st .
AI summary The document mentions providing advance notice to customers about interest-free payment plans to avoid late fees starting October 1st.
100855NS Power's Monthly Update #4 (M12273)
3 passages
Customer Billing and Customer Systems As the Board is aware, customer billing has been affected by the Incident. NS Power continues to address customer concerns as they arise and take proactive steps to address customer questions about est...
AI summary NS Power has been addressing customer billing issues caused by a cybersecurity incident, including implementing manual meter readings, offering flexible billing options, and updating communication with customers through bill inserts and website content. Late fees have been waived, and efforts are underway to reconnect meters to the billing system by March 2026.
Customer Notifications As noted in the Third Monthly Update Report, NS Power has continued to directly notify active customers whose data it has identified as having been impacted. This offers these customers an additional opportunity to s...
AI summary NS Power has completed direct notifications to active customers whose data was impacted, offering them an opportunity to sign up for credit monitoring following five years of free monitoring available to all customers since June 2025.
Thanks to our robust systems, ongoing investments, and the dedication of our people, we ensured that core operations and the electric grid continued uninterrupted – no power was lost to Nova Scotians. There is still much work ahead, and as...
AI summary Nova Scotia Power ensured uninterrupted operations during a recent incident, implementing recovery measures such as IT security upgrades and customer support options. They are addressing billing and payment challenges, removing social insurance numbers from systems, and working to reconnect meters with billing systems by the end of March.
100856NS Power's Monthly Update #5 (M12273)
4 passages
Customer Billing and Customer Systems NS Power has continued to make progress in restoring customer billing capabilities. Smart meter connectivity has been re-established for most customers, enabling the ongoing collection of meter data ne...
AI summary NS Power has restored smart meter connectivity for most customers, with half of meters communicating to the billing system by January 2026. Over 84% of customers received actual reads in January 2026, and over 400,000 meters transmitted usage data. Work continues on re-establishing full billing platform integration, customer self-service portals, and communication tools.
The following projects experienced adjustments to their completion timeline. An overview of the changes and associated rationale is outlined below: Pillar Project Summary of Change Rationale Rates-Related Matters Customer Billing
AI summary The document outlines adjustments to the completion timelines of various projects, with a section dedicated to Rates-Related Matters and Customer Billing, though specific details are not provided in the excerpt.
PO Box 910 ● Halifax, Nova Scotia ● Canada ● B3J 2W5 January 31, 2026 Honourable Tom Taggart, MLA for Colchester North Chair, Nova Scotia Standing Committee on Natural Resources and Economic Development 1700 Granville Street, One Governmen...
AI summary Nova Scotia Power is providing an update on efforts to support customers following a cyber incident, including customer support sessions and improvements in billing, internal controls, and business continuity planning.
b. Customer support mechanisms and communication strategies in the event of system issues. • As noted in (1), recognizing that the estimated billing process raised concerns amongst our customers, we have supported flexible options such as...
AI summary NS Power outlines customer support measures, including flexible billing options, community sessions, and communication strategies post-cyberattack. Efforts focus on reducing disconnections, improving transparency, and collaborating with regulators. Cybersecurity investments and stakeholder engagement are emphasized to address billing concerns and maintain grid reliability.
101623NSPI Monthly Update Report #7 (M12273)
2 passages
Customer Billing and Customer Systems Meter connections to our billing system have been restored, and customer billing is returning to normal as of March 31, 2026. The number of customer bills we must estimate has also returned to normal a...
AI summary Meter connections to the billing system have been restored, with customer billing returning to normal as of March 31, 2026. Estimated bills remain at around 2 percent or less. Customer self-service capabilities are progressing, with recovery timelines detailed in Attachment 1.
The following projects experienced adjustments to their completion timeline. An overview of the changes and associated rationale is outlined below: Pillar Project Summary of Change Rationale Customer OpenView / ActiVu Project end date adju...
AI summary Two projects have had their completion dates adjusted. OpenView/ActiVu's end date was moved from March 16, 2026, to May 14, 2026, due to vendor availability. The IAM project's end date was moved from September 30, 2026, to July 31, 2026, to align with the Identity recovery scope completion.
101692CA (NSPI) IR-1 to IR-11
4 passages
33 Reference: NSPI Customer Privacy Policy 34
AI summary This section references the Nova Scotia Power Inc. (NSPI) Customer Privacy Policy, indicating that the document pertains to privacy practices related to customer data.
2 3 a. Please provide NSPI's customer account collection policies that were in effect as of the 4 date of the incident. 5 6 b. Please confirm that no customer accounts have been sent to credit collection agencies 7 since the date of the in...
AI summary The text requests information regarding NSPI's customer account collection policies, confirmation of accounts sent to credit collection agencies, and any complaints from customers regarding late fees or referrals to collection agencies.
39 Question 40 41 a. For each month following the Incident up to and including the most recent month of 42 actuals available, please provide: 43 44 i. The total number and percentage of customer bills that were estimated. 45 46 ii. The num...
AI summary The proceeding requests Nova Scotia Power Inc. (NSPI) to provide information on estimated customer bills following an incident, including metrics on estimated bills, customer complaints, service metrics, policies for handling complaints, methods used to estimate bills, changes post-incident, and whether interest is credited for overpayments.
23 Reference: Response to NSEB IR-1 in Proceeding M12273 26 "NS Power developed and implemented a consistent multi-channel approach throughout the 27 response efforts for all public communications. For each update, the transparency effort...
AI summary The document outlines NSPI's communication strategy during a public incident, emphasizing multi-channel outreach, and includes questions regarding methods used to reach former customers, adaptability of the communication plan, and reviews of communication effectiveness.
101694NSEB (NSPI) IR-1 to IR-25
4 passages
Request IR-7: - On page 2 of Monthly Update #7, it is noted that the number of customer bills requiring estimation - has returned to normal levels, at around 2% percent or less. In response to IR-14(c), the utility - provided a table indic...
AI summary The document addresses questions regarding the utility's progress in returning to pre-cyber incident levels of estimated bills and provides a request for a breakdown of bills issued post-incident, including customer class, actual reads, and estimated bills.
Request IR-18: - Please provide any memos, assessments, reports or email messages about NS Power's - collection, use, retention and destruction of customer social insurance numbers since April 25, - 2015, 10 years before the cyber attack.
AI summary The document requests information related to NS Power's handling of customer social insurance numbers since April 25, 2015, in the context of a cyber attack that occurred 10 years prior.
Request IR-23: - In a letter to the Honourable Tom Taggart, MLA for Colchester North, Chair, Nova Scotia Standing - Committee on Natural Resources and Economic Development dated January 31, 2026, which - was attached to Monthly Update #5,...
AI summary NS Power discusses overpayment and underpayment scenarios following a cyber-incident, noting a decrease in refund requests and an increase in accounts in arrears. It highlights challenges with isolating actual overpayment and underpayment patterns and outlines steps taken to assist customers in arrears.
Request IR-24: Please provide any memos, assessments, reports or email messages prepared by NS Power, or on its behalf, about concerns raised by customers about overestimated bills.
AI summary Request IR-24 asks NS Power to provide any memos, assessments, reports, or emails related to customer concerns about overestimated bills.
20260818-1Hearing Transcript — 08/18/2026 (Chris Lanteigne, Lia MacDonald, Glen MacLeod, Blake Williams)
11 passages
NOVA SCOTIA ENERGY BOARD IN THE MATTER OF: THE PUBLIC UTILITIES ACT - and - IN THE MATTER OF: AN INQUIRY about the impact of the cyber incident on NOVA SCOTIA POWER INCORPORATED's collection and retention of customer information, customer...
AI summary The Nova Scotia Energy Board is conducting an inquiry under the Public Utilities Act regarding the impact of a cyber incident on Nova Scotia Power Incorporated's handling of customer information, customer service, billing processes, and regulatory matters.
NOVA SCOTIA POWER PANEL 35 Cr-ex, (Roberts) 1 fashion the use of that information? 2 [9:30:08] A. (Williams) Sir, just before, I 3 just want to make sure we have the right reference before 4 we give our 5 It's up on the screen and it's Q....
AI summary The discussion revolves around the types of personal information collected by Nova Scotia Power, including account details, program participation, and date of birth, with explanations provided for why this information is necessary for setting up and identifying customer accounts.
INTERNATIONAL REPORTING INC. CERTIFIED COURT REPORTERS 1 where there's additional verification steps that are 2 required, so in the current process a copy of the 3 customer's identification and driver's licence is one of 4 those sources, w...
AI summary The discussion focuses on the verification and retention of customer information by Nova Scotia Power during account setup. It addresses the use of driver's licence information and whether it is retained in customer records.
NOVA SCOTIA POWER PANEL 45 Cr-ex, (Roberts) 1 The information that's in this list 2 right now, essentially maybe the best way to answer it is 3 what information is currently not retained. 4 So the driver's licence number would 5 not be ret...
AI summary The discussion centers on data retention practices by Nova Scotia Power, specifically regarding the non-retention of driver's licence numbers and Social Insurance Numbers, except for tax reporting. The conversation also touches on credit reporting tools and the factors that may prevent customer identification through these tools.
NOVA SCOTIA POWER PANEL 59 Cr-ex, (Roberts) 1 information. So that suggests that there may be other 9 because of its vintage to remove that type of information, 10 and furthermore, the manual deletion of that volume of 11 information has c...
AI summary The discussion highlights the challenges of manually removing sensitive customer information from the CIS system due to risks of system disruption. Efforts began in 2018 and were intensified in 2024, with plans to implement an updated CIS that can automate the removal of such information in the future.
NOVA SCOTIA POWER PANEL 81 Cr-ex, (Roberts) of, I think she used the word ad hoc , the ad hoc approach between 2018 and 2024 in terms of removal, and waiting six years, essentially, to take a proactive step to remove the SINs. What do you...
AI summary The discussion focuses on the removal of Social Insurance Numbers (SINs) from the Customer Information System (CIS) by Nova Scotia Power. The witness clarifies that SINs were being removed as they were encountered, and by 2024, most had been removed, though some remained in historical records. The removal was not completed by March 2025, but the majority had been purged prior to an attack.
NOVA SCOTIA POWER PANEL 119 Cr-ex, (Roberts) 1 to 20th. 2 So the way, just to elaborate if I 3 could on the way the Customer Service Information 4 estimates bills for customers. As mentioned it is –– it 5 looks at seasons, but the legacy s...
AI summary Nova Scotia Power Inc. (NSP) explained that their legacy billing system estimated customer bills based on seasonal temperatures, leading to higher-than-expected bills in early November. In response, NSP implemented measures such as waiving late fees, offering real-time adjustments via an online forum, and contacting affected customers to correct estimates.
NOVA SCOTIA POWER PANEL 147 Cr-ex, (Roberts) 1 which had a serious data breach in 2019 or 2017. The 2 So I'll start I just wanted to Q. 3 follow up on the request for Undertaking 3, with respect 4 to the amount of SIN numbers. And I'm wond...
AI summary The discussion centers on a data breach involving SIN numbers accessed by Nova Scotia Power. The conversation explores whether the number of SINs accessed corresponds to the number of letters referencing the breach, with clarification that letters were not sent to former customers.
recommendations would be. It would not be I would suggest it would not be unreasonable for there to be timelines associated with certain recommendations, but again, without knowing what the recommendations are, hard for me to say definitel...
AI summary The discussion revolves around the implementation timelines for recommendations and concerns regarding the PI inventory and personal information access by Nova Scotia Power. The witness assures timely implementation of recommendations, while INQ raises concerns about PI inventory and access to personal information.
NOVA SCOTIA POWER PANEL 177 Cr-ex, (MacAdam) for TransUnion's myTrueIdentity service. So that would have been the specifics of why they were regional, because if they were happening in those areas at that time, we wanted to make sure that...
AI summary The discussion revolves around customer notification practices related to TransUnion's myTrueIdentity service, including the timing and scope of notices sent to customers. It also touches on phishing failure rates and the timing of customer sessions.
NOVA SCOTIA POWER PANEL 329 Cr-ex, (Mahody) that's generated as a result of the customers' energy usage is information that Nova Scotia Power has a custodial responsibility as part of the utility/customer relationship? A. (Williams) So as...
AI summary The discussion revolves around Nova Scotia Power's custodial and stewardship responsibilities regarding customer energy usage data. The witness confirms accountability for this information and agrees to retaining it only as necessary for providing electricity services.
20260819-1Hearing Transcript — 08/19/2026 (Chris Lanteigne, Lia MacDonald, Glen MacLeod, Blake Williams)
12 passages
NOVA SCOTIA ENERGY BOARD IN THE MATTER OF: THE PUBLIC UTILITIES ACT - and - IN THE MATTER OF: AN INQUIRY about the impact of the cyber incident on NOVA SCOTIA POWER INCORPORATED's collection and retention of customer information, customer...
AI summary The Nova Scotia Energy Board is conducting an inquiry under the Public Utilities Act regarding the impact of a cyber incident on Nova Scotia Power Incorporated's handling of customer information, customer service, billing processes, and regulatory matters.
INTERNATIONAL REPORTING INC. CERTIFIED COURT REPORTERS 1 output is the output from the system. 2 A. (Lanteigne) I think and just 3 building on what the discussion that I was having with 4 Mr. Mahody earlier as well to, you know, recognizin...
AI summary The witness discusses changes in customer feedback and the promotion of a photo meter read option, noting that the Customer Information System cannot be updated to change estimation routines across the entire system. The witness also clarifies that the billing system produced the bills as generated, countering the suggestion that bills were manipulated to be higher.
NOVA SCOTIA POWER PANEL 389 Questions, (Melanson) 1 estimation had to continue beyond the period that it did, 16 for customers. 17 And in reading the evidence, it Q. 18 appeared to me that there might not be very much done to 19 the existi...
AI summary The text discusses the limitations of the Customer Information System (CIS) in improving estimation accuracy for customers. The discussion highlights the complexity of the system and the lack of feasible modifications to enhance accuracy, such as using data from multiple weather seasons. A new CIS project is mentioned, with a 24-month delivery timeline upon regulatory approval.
NOVA SCOTIA POWER PANEL 399 Questions, (Melanson) change to the actual estimation program in CIS would require programming that, again, as we've talked about, I think is not possible. From our perspective, the ability to determine and info...
AI summary The discussion addresses concerns about programming changes in the Customer Information System (CIS) and potential impacts on billing accuracy and timeliness. It also touches on Nova Scotia Power's commitment to system restoration costs incurred in 2025, which were not reflected in rate increases due to prior approvals in 2022 or 2023.
NOVA SCOTIA POWER PANEL 423 Questions, (Deveau) 1 letter. And you know, intentionally just adding that at 19 I think to add to what Mr. Wiliams indicated, recognizing INTERNATIONAL REPORTING INC. CERTIFIED COURT REPORTERS 1 that the data t...
AI summary The text discusses a question raised regarding the Customer Information System (CIS) and whether it contained customers' Social Insurance Numbers, with the response indicating that such information had been purged from the system.
NOVA SCOTIA POWER PANEL 427 Questions, (Deveau) 1 necessarily affected, so 2 Q. So in the incident report it 3 mentions the it has the questions that TransUnion had 4 access to. I may have missed it, but I don't recall 5 seeing I don't rec...
AI summary The discussion revolves around customer inquiries regarding access to the Customer Information System (CIS) by TransUnion and the scripts used by Nova Scotia Power to handle such inquiries. The witness confirms that TransUnion would not have had access to the CIS and explains the process for handling escalated customer concerns.
INTERNATIONAL REPORTING INC. CERTIFIED COURT REPORTERS 1 based on what you received in your letter.: 2 Q. Okay. I didn't realize that. So 3 they would have access to the TransUnion list of questions 4 that were contained in the incident re...
AI summary The discussion revolves around customer service procedures during a cyber incident, specifically how Nova Scotia Power staff used a separate script to address questions related to the incident, in addition to regular service inquiries.
NOVA SCOTIA POWER PANEL 493 Questions, (Deveau) 1 Okay. Q. 8 A. (Williams) Exactly. So I'm 9 comfortable where we are right now ––– 10 Q. Okay. Yeah. 11 A. (Williams) ––– in continuing this 12 type of discussion. 13 Q. So I have number ––...
AI summary The document is a transcript from a regulatory proceeding involving Nova Scotia Power, discussing the adoption of personal information collection procedures and information management policies. The discussion centers on how these policies apply to Nova Scotia Power and its affiliates under Emera.
NOVA SCOTIA POWER PANEL 503 Questions, (Deveau) 1 it's an audit of access to information that is made 25 I will say it was accurate as it INTERNATIONAL REPORTING INC. CERTIFIED COURT REPORTERS 1 related to CIS because of the discussion we...
AI summary The text discusses a question raised during a regulatory proceeding regarding Nova Scotia Power's communication strategy following a data breach. The question focuses on the involvement of TransUnion in developing a Frequently Asked Questions (FAQ) resource, with the concern that many of the 36 questions relate to the breach itself rather than credit monitoring.
NOVA SCOTIA POWER PANEL 569 Questions, (Chair) what from the boxes was taken. Q. Right. You understand, though, how that might raise questions in a customer's mind in terms of the level of uncertainty and seeing something like this and wan...
AI summary The discussion revolves around customer concerns regarding uncertainty in billing practices, with the company acknowledging the need for transparency. The company explains that sending a letter to customers was necessary to comply with PIPEDA regulations, even if it could not provide definitive details on the impact.
NOVA SCOTIA POWER PANEL 579 Questions, (Chair) 1 been talking about over the last several minutes with 2 regards to the shoulder season issue, it was not something 3 that you know, we had the awareness to make a change in 4 advance of Nove...
AI summary The discussion revolves around Nova Scotia Power's lack of awareness regarding the impact of the shoulder season billing issue before November 1st and the CIS system being overwhelmed by the unprecedented volume of billing disruptions. The system was functioning as intended, but the volume of work was a challenge.
NOVA SCOTIA POWER PANEL 607 Questions, (Chair) 1 Okay. In going up the chart Q. 2 there, the 61 to 91 days, we could have a similar 3 discussion in terms of the pre-cyber levels, that the 4 numbers there are not showing that the outstandin...
AI summary The discussion revolves around the analysis of invoice data, particularly focusing on the number of outstanding invoices in different time ranges, and whether they have returned to pre-cyber levels. The witness acknowledges uncertainty in explaining discrepancies, such as the low number of invoices in the 0 to 35-day range in July.
20260820-1Hearing Transcript — 08/20/2026 (Jena Valdetero, Ed Mollard, Tricia Ralph)
7 passages
RALPH 743 1 MS. RUDDERHAM: No questions, Mr. 12 MR. CLARKE: Page 46 of the rebuttal 13 evidence. 14 BY MR. CLARKE: 15 And at the top of the page we Q. 16 see: 17 18 19 20 21 June 25, 2025: Via substitute notice on its website, in the media...
AI summary The text shows a regulatory proceeding where NSP (Nova Scotia Power Inc.) informed customers about a data breach and extended credit monitoring. The discussion confirms that these actions occurred on June 25, 2025, and that the evidence is from NSP.
INTERNATIONAL REPORTING INC. CERTIFIED COURT REPORTERS A. Yeah, that was my understanding. Q. Okay. And would you agree with me that the steps that were taken with respect to TransUnion and Sogica, that would have taken some time? A. Yes....
AI summary The discussion revolves around the timing and notification process related to an incident involving NSPI, with a focus on the delay in notifying affected customers and the reasons for deeming this delay unreasonable.
RALPH Cr-ex, (Clarke) 1 And here you've written: 4 5 6 7 8 9 The types of impacted personal information varied by individual customer and depended, in part, on the information provided by each customer. This may[include] And I just want to...
AI summary The text discusses the types of personal information impacted, including names, contact details, account history, and financial information, as well as measures taken to provide credit monitoring to affected customers as a precautionary measure.
INTERNATIONAL REPORTING INC. CERTIFIED COURT REPORTERS the SIN letters were sent, Nova Scotia Power understood that those people those people's SINs were involved there, and so they were impacted by the breach. Q. Well, what they said was...
AI summary The discussion focuses on customer confusion regarding the language used in letters sent by Nova Scotia Power following a data breach, where it was stated that personal information 'may have been impacted.' Customers found this language unclear, as it did not clearly indicate that their SINs were accessible to a threat actor.
information, and they weren't sure whether or not they provided it and whatnot. And then the response of Nova Scotia Power when people called to ask that, which to me RALPH Cr-ex, (Clarke) INTERNATIONAL REPORTING INC. CERTIFIED COURT REPOR...
AI summary This text discusses customer concerns about unclear communication from Nova Scotia Power regarding data breaches and information disclosure. The witness, Ralph Clarke, notes that the company's response was not helpful, and that customers would have preferred a clearer explanation.
s the reason 14 why." 15 Q. You don't think that the content 16 of this letter in its totality offers that message? 17 A. I think it's unclear. 18 Q. I see. Okay. 19 MR. CLARKE: Can we go to Ms. 1 Valdetero's opinion, page 16, please? 2 BY...
AI summary The discussion centers on whether Nova Scotia Power's decision to send two different letter versions to customers, based on whether they possessed their Social Insurance Numbers (SIN), was appropriate. The opinion highlights that providing certainty about SIN usage was highly appropriate due to the sensitivity of SIN data.
practitioners disagree, and I think for me, again, back to the customer perspective, it was clear from my reading of the information from the letters and emails and whatnot, from I guess it was mostly emails, but from customers, it was con...
AI summary The text discusses customer confusion and communication issues following a cybersecurity incident, with a focus on transparency and reasonable steps taken by Nova Scotia Power. The discussion includes customer reactions, the need for clearer communication, and the reasonable expectations of affected customers.