N-1LOCs Redacted (N-1 from M12273)
12 passages
From: Painting-MacLean, Kimberly To: Painting-MacLean, Kimberly Subject: M12273 Administrative Demand for Structural Redress – NSUARB Oversight Failure and NS Power Identity Breach Date: May 23, 2025 10:11:33 AM Attachments: Administrative...
AI summary An administrative demand for structural redress has been filed regarding NSUARB oversight failure and an NS Power identity breach. The demand is related to unlawful contracting structures enabled by NSERBT oversight failures, citing previous decisions and responses from NSERBT.
\ \ EXTERNAL EMAIL / COURRIEL EXTERNE \ \ Exercise caution when opening attachments or clicking on links / Faites preuve de prudence si vous ouvrez une pièce jointe ou cliquez sur un lien To: Michael Savage acting as Chief Executive Office...
AI summary This email requests formal review and structural accountability from Nova Scotia's executive leadership regarding governance failures by the Nova Scotia Energy and Regulatory Boards Tribunal (NSERBT) and Nova Scotia Power's (NS Power) use of unconscionable contracting mechanisms. It highlights concerns about unlawful contract formation and identity breach issues.
Subject: Administrative Demand for Structural Redress — Identity Breach and Unlawful Contracting Structures Enabled by NSERBT Oversight I am a resident of Nova Scotia who has undertaken a thorough examination of the structural failures gov...
AI summary The document outlines a formal administrative demand for structural redress due to an identity breach by Nova Scotia Power, attributed to unlawful contracting mechanisms upheld by the Nova Scotia Energy and Regulatory Boards Tribunal (NSERBT). The breach is linked to systemic governance failures and poses material risks to residents.
1. Contracts Without Capacity, Consent, or Jurisdiction NS Power has been permitted to "deem" contractual relationships into existence with residential customers under Board-approved Regulation 2.2. This allows an essential service to be d...
AI summary NS Power is allowed to create presumed contractual relationships with residential customers without signed agreements, visible terms, or clear jurisdictional authority, raising concerns about lawful contracting and consumer rights.
3. Identity Breach as Confirmation of Administrative Failure I am in possession of an identity breach notification issued by NS Power to a customer whose relationship with the company is governed by the same presumed contract structure I c...
AI summary The text discusses an identity breach by NS Power, highlighting administrative failures in the contracting frameworks approved by NSERBT. It argues that these frameworks fail to protect residents and lack legal authority to handle sensitive personal information without valid contracts.
4. Administrative Exhaustion and Lack of Remedy I have pursued structural remedy through formal submissions, appeals, and letters of comment including my public letter in Matter M11411. At each stage, I have been met with jurisdictional de...
AI summary The applicant has pursued multiple avenues to seek a structural remedy, including formal submissions, appeals, and letters of comment. However, they have faced jurisdictional deferral or regulatory minimization. They argue that residents are bound to a monopoly utility through invalid contracts and that the NSERBT has failed in its duty of care.
Demands for Structural Redress As the public authority responsible for overseeing the composition, mandate, and accountability of the NSERBT, I demand the following: - 1. A formal administrative review of the NSERBT's continued enforcement...
AI summary The document outlines demands for structural redress concerning the NSERBT's enforcement of Regulation 2.2, concerns about residents being subrogated into contracts with NS Power without informed consent, and the need for accountability in regulatory oversight. It also calls for a moratorium on rate increases until contractual relationships are based on lawful consent and a clear statement of ministerial responsibility.
Hello, I understand that the NS energy board is investigating the NSP response to the breach that occurred. Perhaps the investigation should include the fact that those of us who received a letter to sign up for credit monitoring includes...
AI summary Allan Cardinal reports that Nova Scotia Power (NSP) provided invalid activation codes to customers affected by a data breach, exacerbating the issue and showing a lack of proper response. He urges the NS energy board to investigate NSP's inadequate handling of the situation.
Hello I understand that your department will be investigating the NS power privacy breach and NSP response. I received a letter from NSP that i was one of the affected. The only thing that nsp is doing in respect to us the clients who were...
AI summary The complainant reports a data breach by NS Power (NSP) and criticizes their inadequate response, such as providing a non-functional link for credit monitoring and lack of dedicated support. The complainant also questions the effectiveness of NSP's actions and urges regulatory scrutiny.
port, paired with the magnitude of a potential identity theft, raises serious concerns about the utility's obligations to ratepayers and public accountability. I respectfully request that the NSUARB: - 1. Investigate NS Power's conduct dur...
AI summary A customer raises concerns about Nova Scotia Power's handling of a data breach, including the potential exposure of sensitive personal information, and requests the NSUARB to investigate, ensure transparency, and assess whether customers are entitled to compensation or restitution.
Hello Back in May I received the NS Power letter regarding the cyber incident. I tried setting up an account with TransUnion online as the letter requested. That didn't work and I was told to call a number. I called that number and there w...
AI summary The individual details a frustrating experience with NS Power and TransUnion while trying to set up an account following a cyber incident. He encountered repeated issues with being put on hold, unclear assistance, and being directed to multiple numbers without resolution. He expects NS Power and the Nova Scotia Energy and Regulatory Boards Tribunal to resolve the issue.
eding does not currently establish where customer personal information is stored, which vendors and subprocessors hold it, in what jurisdiction, or what exposure that creates to foreign legal process. Why this is within the inquiry's scope...
AI summary The document highlights concerns about where customer personal information is stored, who has access to it, and the implications for ratepayers. It argues that this information is central to the inquiry and the Board's mandate, as it relates to prudent utility practices and ratepayer costs. The request is for the Board to require NS Power to disclose jurisdiction-level information about data storage and legal exposure, even if technical details are confidential.
N-14Evidence & Appendix A Resume - Tricia Ralph INQ Law/Consulting - BCC
3 passages
B. Introduction - 1. I have been retained by Counsel for the Nova Scotia Energy Board ("NSEB") to carry out a review of NSPI's privacy related practices in relation to the cybersecurity incident NSPI identified on April 25, 2025 (the "Inci...
AI summary This report outlines a review of NSPI's privacy practices following a cybersecurity incident identified on April 25, 2025. The reviewer was retained by the Nova Scotia Energy Board to assess the reasonableness of NSPI's actions in delivering services to its customers.
D. Methodology 5. In order to come to my opinions, I reviewed the 2025 Nova Scotia Power's Cybersecurity Incident Report (the "Incident Report") and responses to my Information Request ("IR") to NSPI, as well as relevant information in oth...
AI summary The methodology section outlines the review of NSPI's 2025 Cybersecurity Incident Report and responses to an information request, using PIPEDA principles as a benchmark for evaluating the reasonableness of NSPI's actions without interpreting PIPEDA itself.
Issue 3 – Reporting and Notification - 32. Board counsel has asked that I provide an opinion on the reasonableness of NSPI's actions in relation to the Incident in delivering services to its customers concerning reporting to regulators, an...
AI summary The document addresses Issue 3 – Reporting and Notification, focusing on NSPI's actions regarding a data breach incident. NSPI believes an unauthorized third-party accessed its systems around March 19, 2025, and exfiltrated customer data, including personal information, which was discovered on April 25, 2025. The Board is evaluating the reasonableness of NSPI's reporting and notification practices.
N-16NSPI Refiled Formal Incident Report - Redacted (filed in M12273 as N-5 on April 27, 2026)
3 passages
REDACTED 1 In addition, the Company deployed dozens of employees to communities across the 2 province to provide hands-on support for customers who prefer assistance in person, 3 recognizing that not all customers may be comfortable regist...
AI summary NS Power deployed employees to assist customers in person and updated its website to improve access to services. The company has implemented cybersecurity standards aligned with NIST and NERC, and has completed a two-year update to its cybersecurity practices. NERC conducts periodic audits of NS Power's energy operations.
REDACTED 1 NS Power maintains a cybersecurity training and awareness program and conducts 2 mandatory quarterly cyber training and monthly phishing simulation testing exercises with 3 all employees to educate employees about NS Power's inf...
AI summary NS Power has implemented a cybersecurity training and awareness program, including mandatory quarterly training and monthly phishing simulations. Following a cybersecurity incident, NS Power activated its incident response protocols, engaged third-party experts, and initiated containment, eradication, and remediation efforts. Ongoing restoration and strengthening of cyber security systems are also being prioritized.
Page 2 attack. - 4. There are highly sensitive and confidential details relating to NS Power's incident response that the company intends to share with the Board, including in the Report.
AI summary The text notes that NS Power plans to share highly sensitive and confidential details about its incident response with the Board, including in the Report.
N-17NS Power Rebuttal Evidence - Redacted
6 passages
Cybersecurity Accountability REDACTED of an audit regime considering the OPC compliance process audit and to ensure any regime is consistent with the outcome of that process. Recommendation 4: InterGroup recommends the Board direct NS Powe...
AI summary The document discusses a recommendation for NS Power to update its Communications Policy to notify all customers in the event of a privacy breach, which NS Power opposes, arguing that such notifications are not required by law and could lead to notification fatigue. NS Power emphasizes that privacy laws like PIPEDA require notifications only to those affected by a breach.
The reasonableness of NS Power 's actions regarding use of a PI inventory. INQ notes: An adequate PI inventory as a privacy program control is a critically important building block. In their guidance, the regulators explain that organizati...
AI summary The document discusses concerns regarding the adequacy of NS Power's PI inventory practices, noting that NSPI did not provide a copy of the inventory and claimed it could not determine what data points were exposed during an incident, raising questions about the completeness of their privacy program controls.
Reasonableness of credit monitoring offer - NS Power wishes to also address INQ's finding that the initial offer of two years of credit - monitoring was not reasonable, while the subsequent offer of five years was reasonable. 38F [39](#pag...
AI summary NS Power defends its initial offer of two years of credit monitoring following a data breach, arguing it aligns with industry standards in Canada. It acknowledges that extending the offer to five years was reasonable. The discussion highlights the absence of legal or regulatory requirements for credit monitoring duration in Canada, with industry practice commonly favoring two years.
Cybersecurity Accountability Rebuttal Attachment 1 Page 4 of 32 REDACTED (CONFIDENTIAL INFORMATION REMOVED) Inquiry into NS Power's Cybersecurity Incident – Evidence of Jena Valdetero NON-CONFIDENTIAL - 1 questions of legal interpretation...
AI summary Jena Valdetero, an expert in data security and privacy law, provides an opinion on whether NS Power acted reasonably in response to a cybersecurity incident. She has extensive experience managing data security incidents and advising on privacy laws, including PIPEDA and similar legislation.
8 Summary of Ms. Ralph's Finding 9 At paragraph 46 of the Ralph Report, Ms. Ralph concludes that the approximately two-month 10 delay between the discovery of the Incident on April 25, 2025, and the public notification to former customers...
AI summary Ms. Ralph found that NS Power's two-month delay in notifying former customers about a data incident was unreasonable. She noted that NS Power should have been aware of former customer data in its systems and should have assessed if it was impacted. Best practices require notification within days unless extenuating circumstances exist, which were not identified.
Cybersecurity Accountability Rebuttal Attachment 1 Page 25 of 32 REDACTED (CONFIDENTIAL INFORMATION REMOVED) Inquiry into NS Power's Cybersecurity Incident – Evidence of Jena Valdetero NON-CONFIDENTIAL 1 that can be easily used to search f...
AI summary The text discusses the limitations of using Canada Post's NCOA database and TransUnion's address validation service for notifying former NS Power customers. Both options are deemed unreliable or impractical due to data limitations, time constraints, and potential negative impacts on customer credit reports.
N-23M12835 Exhibit N-2 Att 3 2025 Managements Discussion AnalysisHIGHLIGHTED
6 passages
The forward-looking information is based on reasonable assumptions and is subject to risks, uncertainties and other factors that could cause actual results to differ materially from historical results or results anticipated by the forward-...
AI summary The forward-looking information provided is based on reasonable assumptions but is subject to various risks and uncertainties, including regulatory, economic, technological, environmental, and operational factors that could impact actual results significantly.
livery obligations. In 2025, NSPI derived more than 40 per cent of its electric sales from renewable sources and achieved a 49 per cent reduction in generation from solid fuel compared to 2005 levels. NLH is obligated to provide NSPI with...
AI summary NSPI has significantly increased its renewable energy sales, reaching over 40% in 2025 and reducing solid fuel generation by 49% compared to 2005. NSPI has a long-term energy agreement with NLH, including obligations and options for purchasing additional energy. The company is collaborating with the provincial government to meet ambitious renewable energy targets and address climate change.
Nova Scotia Energy Reform Act: On October 15, 2025, the Nova Scotia Independent Energy System Operator ("IESO Nova Scotia") announced that the organization will be phased in over two phases during an 18-month period. On December 1, 2025, t...
AI summary The Nova Scotia Independent Energy System Operator (IESO Nova Scotia) is being phased in over an 18-month period, with the first phase completed in December 2025 and the second expected in 2027. This transition follows the enactment of Bill 404 - Energy Reform (2024) Act in April 2024, which established the Nova Scotia Energy Board (NSEB) and initiated the transition to IESO Nova Scotia.
Regulatory and Political Risk NSPI is subject to complex legislative and regulatory frameworks that cover material aspects of their businesses. These frameworks influence key factors such as rates and cost structures, revenue requirements,...
AI summary NSPI operates under a complex regulatory framework that influences rates, revenue, and capital investments. Regulatory delays, disallowance of costs, or changes in policy could lead to Material Adverse Effects. The IESO Nova Scotia's operational status remains uncertain, and changes in environmental legislation may further impact regulatory stability.
Nova Scotia Energy Reform Act: On April 5, 2024, the Province enacted Bill 404 - Energy Reform (2024) Act. This legislation implements certain recommendations made by the Clean Electricity Solutions Task Force, which was established by the...
AI summary The Nova Scotia Energy Reform Act, enacted in April 2024, establishes the NSEB and the IESO Nova Scotia to regulate energy entities and facilitate the transition to renewable energy. The IESO Nova Scotia is being phased in over two years, with the first phase completed in December 2025 and the second phase expected in 2027.
Supply Chain Risk NSPl's ability to meet customer energy requirements, respond to storm-related disruptions and invest in capital in a cost-effective and timely manner are dependent on maintaining an efficient supply chain. Domestic and gl...
AI summary NSPI's ability to meet energy demands, manage disruptions, and invest in capital is dependent on an efficient supply chain. Supply chain issues, trade restrictions, inflation, labor shortages, and international conflicts could delay deliveries, increase costs, or cause shortages of critical materials and resources.
102158Board Decision Letter - Request for Pre-Approval of Intervener Costs
4 passages
fairness and the efficiency and effectiveness of the regulatory proceeding itself. The Board is not a court and is not bound by the same detailed rules of civil procedure that courts typically follow. Board proceedings are open to the publ...
AI summary The document discusses the regulatory process of the Board, emphasizing its openness to the public, alternative participation methods, and considerations for requesting costs. It highlights that the Board is not bound by court procedures and can conduct proceedings virtually, ensuring accessibility and cost-effectiveness.
siderable experience dealing with virtual and hybrid proceedings. This experience has demonstrated that virtual processes can facilitate access and participation in Board proceedings and reduce costs. The Board is not satisfied that you ha...
AI summary The Board emphasizes that virtual processes in regulatory proceedings are effective, reduce costs, and do not compromise procedural rights. It notes that virtual cross-examination is routine and that electronic document management is standard. The Board also acknowledges potential technological issues but has processes in place to address them and offers platform demonstrations.
ings the ability to arrange for a demonstration of its virtual platform in advance to ensure that the participants are familiar with its systems and to address any technical issues before the hearing. To conclude, the Board's experience wi...
AI summary The Board emphasizes the effectiveness of virtual processes in reducing costs and encourages participation via its virtual platform. It also addresses the adequacy of NS Power's cybersecurity policies, detection and response to a breach, and remedial measures.
ices and controls prior to the breach: - b. The reasonableness of NS Power's detection and response to the breach; and - c. The appropriateness of NS Power's remedial measures and future preparedness. Those issues are intended to be addres...
AI summary The document outlines issues related to the detection, response, and remedial measures taken by NS Power following a breach, with a focus on the reasonableness and appropriateness of these actions. It also references the alignment of issues with the scope of Matter M12273 and provides information about the Board's position and the opportunity for interested parties to intervene.
101524David MacLeod (NSPI) IR A-1 to G-5
4 passages
IR C-4 — Regulatory and Law Enforcement Notification - (a) Provide a complete timeline of NSP's notifications to regulatory and law enforcement - bodies following discovery of the Attack, including: - (i) notification to the NSEB / UARB; -...
AI summary The document requests a timeline of NSP's notifications to regulatory and law enforcement bodies after a cyberattack, identifies the legal obligations for each notification, and explains NSP's rationale for not making a ransom payment.
IR F-3 — Third-Party Cybersecurity Assessments - (a) Identify all third-party cybersecurity assessments, audits, penetration tests, vulnerability - assessments, or red team exercises conducted for NSP in the five years prior to the Attack,...
AI summary The document requests information on third-party cybersecurity assessments conducted for Nova Scotia Power (NSP) in the five years prior to a cyberattack, including details on the firms involved, assessment scope, findings, and NSP's responses. It also asks for unaddressed findings at the time of the attack and explanations for their non-remediation.
GROUP G — POST-INCIDENT REMEDIATION AND FORWARD COMMITMENTS - These Interrogatories address NSP's post-attack remediation program, the adequacy and pace - of that program, and NSP's forward commitments to prevent recurrence. They are relev...
AI summary This section addresses NSP's post-incident remediation efforts, their adequacy and pace, and forward commitments to prevent recurrence. It is relevant to the Board's evaluation of NSP's accountability and whether ratepayers should bear remediation costs.
IR G-3 — Attribution and Threat Actor Identification - (a) NSP's Monthly Update 6 (March 2026) and related reporting attributed the Attack to - "Russian threat actors." Provide all information available to NSP regarding the attribution - o...
AI summary The document requests Nova Scotia Power (NSP) to provide details on the attribution of a cyberattack, including the identity of the threat actor, methodology used, and whether the threat actor is subject to sanctions. It also asks how this knowledge has informed NSP's cybersecurity strategy.
102158Board Decision Letter - Request for Pre-Approval of Intervener Costs
3 passages
3rd Floor, 1601 Lower Water Street Halifax, Nova Scotia B3J 3P6 Mailing Address PO Box 1692, Unit M Halifax, Nova Scotia B3J 3S3 TEL 902-424-1332 FAX 902-424-3919 TF 1-833-809-0040 [email protected] nserbt.ca/nseb May 27, 2026 dt macleod...
AI summary Nova Scotia Power Incorporated requested pre-approval of intervenor costs under Rule 8 of the Board's Costs Rules, but was opposed by NS Power, which argued that the applicant's interest did not represent an organized public interest or identifiable group interest. The Consumer Advocate and Small Business Advocate did not take a position on the matter.
fairness and the efficiency and effectiveness of the regulatory proceeding itself. The Board is not a court and is not bound by the same detailed rules of civil procedure that courts typically follow. Board proceedings are open to the publ...
AI summary The document discusses the regulatory process of the Board, emphasizing its openness, alternative participation methods, and the consideration of cost reasonableness. It notes that in-person attendance is not mandatory and virtual proceedings can be effective.
siderable experience dealing with virtual and hybrid proceedings. This experience has demonstrated that virtual processes can facilitate access and participation in Board proceedings and reduce costs. The Board is not satisfied that you ha...
AI summary The Board emphasizes the effectiveness of virtual processes in regulatory proceedings, stating that virtual cross-examination is routine and reduces costs. It also notes that exhibits are typically managed electronically, and processes are in place to address technical issues. The Board does not require in-person attendance for effective proceedings.
20260819-1Hearing Transcript — 08/19/2026 (Chris Lanteigne, Lia MacDonald, Glen MacLeod, Blake Williams)
5 passages
NOVA SCOTIA ENERGY BOARD IN THE MATTER OF: THE PUBLIC UTILITIES ACT - and - IN THE MATTER OF: AN INQUIRY about the impact of the cyber incident on NOVA SCOTIA POWER INCORPORATED's collection and retention of customer information, customer...
AI summary The Nova Scotia Energy Board is conducting an inquiry under the Public Utilities Act regarding the impact of a cyber incident on Nova Scotia Power Incorporated's handling of customer information, customer service, billing processes, and regulatory matters.
- on anything sort of specific or from his point of view in terms of what we mean by those words. - A. (Williams) I certainly agree with what Ms. MacDonald has said, sir. There's no one aspect to this that I can point to that's demonstrati...
AI summary The discussion emphasizes the importance of accountability and transparency in regulatory processes, highlighting the need for a comprehensive approach in interactions with regulatory bodies such as the OPC. It stresses the significance of how processes are conducted, including evidence provision and responsiveness.
NOVA SCOTIA POWER PANEL 453 Questions, (Deveau) 1 reporting structure may differ. INTERNATIONAL REPORTING INC. CERTIFIED COURT REPORTERS 1 to the incident because it ––– 2 Q. Yeah, and I ––– 3 (Williams) ––– it absolutely ––– A. 4 Q. I did...
AI summary The text discusses the reporting structure and privacy practices at Nova Scotia Power Inc., including the role of the Executive VP of Legal, Regulatory, and GR in reporting privacy matters to the Board of Directors, as well as a new practice of making privacy a standing agenda item in quarterly meetings.
NOVA SCOTIA POWER PANEL 503 Questions, (Deveau) 1 it's an audit of access to information that is made 6 Nova Scotia Power. 7 (Lanteigne) Nova Scotia Power, A. 8 and advisors that we had ––– 9 Yeah. Q. 10 (Lanteigne) ––– secured as well A....
AI summary The text is a transcript excerpt from a regulatory proceeding involving Nova Scotia Power, focusing on an audit of information access. It includes references to Nova Scotia Power and its advisors, as well as a mention of a certified court reporter.
VALDETERO 633 1 Q. Okay. Thank you. 2 AKCAKIRYAN: Those are all my MS. 3 questions. 4 THE CHAIR: Thank you. 5 Industrial Group? 6 MS. RUDDERHAM: No questions, 7 Mr. Chair. Thanks. 8 THE CHAIR: Department of Energy? 9 KAYTER: No questions,...
AI summary This excerpt from a regulatory proceeding includes cross-examination of Ms. Valdetero by Mr. Mahody, focusing on her experience with data privacy and security in regulated utilities, including telecommunications providers and utilities in the United States. She discusses her role as external counsel for multiple companies.