Nova Scotia Power to expand credit monitoring to all customers, past and present
Offer comes in the wake of a massive cybersecurity breach in March
Nova Scotia Power is expanding its offering of free credit monitoring in the wake of a massive cybersecurity breach that resulted in the data of hundreds of thousands of customers being stolen by hackers.
The company is now providing five years of credit monitoring, up from the two years that were initially offered. People who have already signed up will have their service automatically extended.
The utility also announced it will pay for monitoring for all its customers, past and present, instead of just the customers who were believed to have been affected. An update on the company's website Wednesday said the information of former customers was also taken — not just that of current customers.
Nova Scotia Power announced publicly on April 28 that it was dealing with a cybersecurity incident it discovered three days earlier, on April 25. The company later said the actual hack had occurred more than a month earlier, on March 19.
About 280,000 customers have been affected by the attack — about half of the utility's total customers.
Nova Scotia Power is still determining how many former customers were impacted, a spokesperson said in an email.
Because the utility does not have updated contact information for many of those people, it is using a broad notification to "encourage anyone who is concerned about their protection" to register for the extended credit monitoring, the email said.
The company said in its update it is still trying to determine the full scope of data that was accessed, but it "cannot rule out the possibility" that the stolen information includes name, date of birth, bank account number, social insurance number, driver's licence number, phone number, email address, mailing and service address, and customer account information.
The company also said it has "heard concerns" about social insurance numbers, which Nova Scotia Power "historically collected for customer authentication purposes."
"We are committed to permanently deleting all instances of SINs from our systems as soon as our investigation allows," the statement said.
