What's going on with Nova Scotia Power's billing in wake of ransomware attack

Nova Scotia Power is sending workers out to manually check power meters at homes to ensure accurate billing, as some customers complain of receiving higher than expected bills.

It's the latest development since a ransomware attack breached the company's computer systems on March 19 and brought some of its systems to a halt. More than half of the utility's customers in Nova Scotia — about 280,000 — were informed by letter that their personal information may have been compromised.

"The meters on customers' homes have continued to accurately record energy use throughout the cyber incident, but they're unable to send the information back to our billing systems right now," Chris Lanteigne, Nova Scotia Power's director of customer care, told CBC's Information Morning Nova Scotia in an interview that aired Monday.

Lanteigne said meters that previously could send power usage data directly to Nova Scotia Power haven't been able to do that since the breach. He said he expects workers who read meters will be out collecting data "over the next couple of months."

He said bills that have been sent out over the last month were based on estimates of "seasonal usage from the previous  year."

"When we are reading the meter, that will actually show the information that's on the meter to generate the bill," Lanteigne said.

He said customers should call Nova Scotia Power directly if they're concerned about a bill.

"We want to help them understand what has transpired on their bill and we're happy to talk it through with them and find a solution," he said.

Billing was paused on April 25 — when the breach was discovered — and only resumed in early June. Now, some customers are receiving two bills within a relatively short period of time.

"Over the course of the last five weeks or so, we've been catching up on billing," Lanteigne said.

"So when customers are receiving a bill, a good way to think about it is the first one is catching up and then the time between that bill and the next bill will be shorter."

He said the utility is not currently charging late fees on outstanding balances.

Customer with solar panels gets 'significantly higher' bill

Robyn Brown, a Nova Scotia Power customer in Dartmouth, has had solar panels on her home since September 2022. She said her bill is usually around $40 every two months — the cost of the meter fee, since the panels generate more electricity than she uses. Her latest bill was around $162, more than four times higher than normal.

"It's not a lot of money compared to other people, but it was significantly higher," Brown said.

People with solar panels get data about their power generation during a billing period. Brown said she noticed the latest bill didn't include that information.

She called the company for answers and said she was told they weren't able to track her solar production.

"I was like, 'How did you come up with this number?" … and basically [the customer service representative] didn't know where they generated this estimate from because it didn't make sense with any of my previous data. [She] said it could have been data from as far back as 2022 before I got solar."

Brown said she was told she could pay the higher amount, which would eventually be reflected on her account as a credit, or she could wait. She said she paid the amount for the meter fee.

"My concern is the fact that they don't seem to have an accurate read on how much solar producers are producing and I'm worried. What's my recourse if they come back with the next adjusted bill next month and there's no solar on there? Like what are they going to do then?" Brown said.

The Nova Scotia Energy Board, formerly known as the Utility and Review Board, opened a proceeding into Nova Scotia Power's cybersecurity breach. It will require a report from the company — which is doing its own investigation — about the incident.

The report to the energy board must include:

• An incident description.
• Details on affected systems and data, indicators of compromise (how the company knew a breach happened).
• A root-cause analysis (how the breach happened, plus vulnerabilities and security gaps).
• Impact analysis.
• Response and recovery actions.
• Details on collection and retention of personal data.
• Recommendations.

"While the board appreciates that it will not be possible to publicly disclose certain information for security reasons and to mitigate impacts relating to personal and confidential information that was stolen, it is important that the board's inquiry be conducted publicly and as transparently as possible," a news release from the board said Monday.

Once the report is filed, the board will establish a public process to review it and Nova Scotia Power's planning for and response to the event that happened.

The board wants Nova Scotia Power to file the report by the end of the year, though that deadline could change.