Nova Scotia Power Unsure Why Hacked Customer Data Wasn't Deleted

Nova Scotia Power Inc. executives are grappling with the question of why a large volume of customer data, later stolen in a cyberattack, was not automatically purged from their systems as per company policy.

The data breach, which occurred in March 2025, exposed the personal information of hundreds of thousands of customers. This included sensitive details such as addresses, phone numbers, banking information, and social insurance numbers. The company believes the attackers were based in Russia.

“

The utility does not know why the file, created in 2021 and still present in the system in 2025, was never deleted.

Blake Williams, an executive at Nova Scotia Power, informed a regulatory hearing that the utility has systems designed to automatically delete certain data within 90-day cycles. However, the specific file in question, created in 2021, remained in the system until 2025. Williams stated that the reason for this failure to delete the data is currently unknown.

Had the data been deleted as intended, Williams noted, it would not have been available to the cybercriminals. The incident raises significant questions about the company's data retention and security protocols.

“

If it had been destroyed as intended, Williams says the information would not have been available to the attackers.