TL;DR: Hackers had access to Nova Scotia Power systems from March 19 to April 25, 2025. About 280,000 people were notified. Stolen data includes names, addresses, birth dates, driver’s licence numbers, bank account numbers and, for some, Social Insurance Numbers. The company confirmed the data was published on the dark web. The federal Privacy Commissioner opened an investigation. If you’re a customer, treat this as a long-term identity risk, not a two-year one.
What happened
According to The Record, attackers were inside Nova Scotia Power’s systems for about five weeks, from March 19 to April 25, 2025. The utility isolated servers to stop further intrusion; its customer care line and MyAccount portal were affected, but the power stayed on.
Global News reported the company confirmed the stolen data was published on the dark web, and that federal Privacy Commissioner Philippe Dufresne opened an investigation on May 28, 2025 after receiving complaints.
What data was exposed
Exposure varied by customer, but the list includes:
| Data | Risk |
|---|---|
| Names, addresses, birth dates, emails | Targeted phishing, impersonation |
| Driver’s licence numbers | ID fraud |
| Bank account numbers (some customers) | Fraudulent debits, payment scams |
| Social Insurance Numbers (some customers) | Credit fraud, tax and benefit fraud |
| Billing, payment and credit history | Convincing "account problem" scams |
| Power use, service requests, correspondence | Social engineering detail |
The criticism
Experts quoted by Global News said the notification letters lacked detail about what could go wrong, and that two years of TransUnion credit monitoring may not be long enough since criminals can use data well beyond 24 months. A SIN doesn’t expire, after all.
What customers should do
- Sign up for the free credit monitoring offered in your letter, through the official link.
- Place a fraud alert with Equifax and TransUnion. See our fraud alert guide.
- Tell your bank your account number was exposed and watch for unfamiliar debits.
- If your SIN was exposed, follow our stolen SIN guide and check your CRA My Account for changes.
- Distrust "Nova Scotia Power" calls and texts about overdue bills or refunds. Scammers now know your billing history. Call the number on your real bill.
- Keep checking for years, not months. Order your free credit report regularly.
Your rights
Under PIPEDA, you can complain to the Privacy Commissioner if you think a company mishandled your data. See breach notification rights in Canada.
A free email exposure check shows which other breaches your email appears in. Combined leaks are what make identity theft easy.
Frequently Asked Questions
When was the Nova Scotia Power data breach?
Hackers had access from March 19 to April 25, 2025.
How many people were affected?
About 280,000 people were notified.
Were SINs exposed in the Nova Scotia Power breach?
Yes, for some customers, along with bank account numbers and driver’s licence numbers.
Was the data published online?
Yes. The company confirmed the stolen data was published on the dark web.
Is the Privacy Commissioner investigating?
Yes. The federal Privacy Commissioner opened an investigation on May 28, 2025.
Sources
- The Record: Nearly 300,000 impacted by Nova Scotia Power cyberattack
- Global News: Federal privacy czar investigates Nova Scotia Power breach