Regulator plans two-part inquiry into last year’s cyberattack at N.S. utility

HALIFAX — Nova Scotia’s energy regulator is planning a two-part inquiry into last year’s cyberattack at the province’s private power utility.

One set of hearings will examine the technical aspects of the March 2025 cyberattack at Nova Scotia Power where the personal information of 280,000 customers was accessed. Company officials have said the attack was likely by a Russia-based actor.

The Nova Scotia Energy Board has decided that a separate investigation will look at how the utility collected and stored customer data and how it estimated bills after losing communication with power meters.

The plans for the two probes are the latest in a nearly year-long crisis at Nova Scotia Power which has faced a barrage of complaints, legal threats and a separate investigation by the Office of the Privacy Commissioner of Canada due to the cyberattack.

Politicians have said some of their constituents’ power bills have spiked since the attack, and Premier Tim Houston has criticized the utility over inflated bills and reports of consecutive charges within short periods. The premier, also the provincial energy minister, wrote to the energy board in December pushing for a separate inquiry on those matters.

The premier’s communications director, Stephen Moore, said in an email that Nova Scotia Power must be held accountable for its response. He said there’s still no clarity around how the estimated bills were calculated and there’s been no urgency to correct them. He said the utility has caused confusion, financial strain and a loss of public confidence in the power system.

“They’re leaving many customers in the dark. This is unacceptable. Nova Scotians deserve better,” wrote Moore.

“We’re not satisfied on any front. That’s why, as energy minister, the premier called on the energy board to launch a formal investigation into billing practices, work to get all systems back online and protections and support for customers. This matter deserves as much scrutiny as the cybersecurity incident itself in order to hold Nova Scotia Power to account.”

Utility officials said last week that the system estimates bills based on “warm” months and “cold” months. They said November marked the start of cold month estimates, causing a sudden spike in projected bills instead of the gradual increase customers would usually see as temperatures dip through the fall.

The Emera Inc.-owned company said Monday that it welcomes the hearings and will fully co-operate with the energy board as well as the federal privacy commissioner. The utility notes it has been providing monthly updates to the energy board.

“We are fully committed to transparency and have been keeping our customers and regulators regularly informed since the cyber incident occurred,” spokesperson Jacqueline Foster said in an email.

The main provincial inquiry will look into the utility’s cybersecurity assets, policies, planning and training before the attack as well as its technical response, recovery actions and security enhancements it has made in the last year. Hearings are not yet scheduled.

The second inquiry will be focused on the premier’s concerns and examine how Nova Scotia Power collected and stored customer information, what it did to protect ratepayers from fraud and identity theft, billing estimates, communications with customers and business impacts. That inquiry is scheduled to hear from witnesses in July.

The utility also faces a potential court battle with its customers.

In December, Halifax-based MacGillivray Injury and Insurance Law filed a proposed class action in the Supreme Court of Nova Scotia alleging data governance breakdowns, utility-wide responsiveness failures and inaccurate billing impacting hundreds of thousands of customers.

Meantime, customer rates are likely on the rise.

The power utility has proposed residential rate increases of about eight per cent by next year. If approved, the first 3.8 per cent increase would be effective retroactive to Jan. 1, and the second 4.1 per cent hike would come into effect Jan. 1, 2027.

The allegations have not yet been tested in court.

This report by The Canadian Press was first published Feb. 9, 2026.

Devin Stevens, The Canadian Press