Nova Scotia Power says it believes it knows who stole customer data

The head of Nova Scotia Power says the company believes it knows who stole customer information in a recent ransomware attack.

However, CEO Peter Gregg says he can't disclose that information, as the company's investigation is ongoing.

"We do have a good sense of who the threat actor is," Gregg told CBC's Information Morning Nova Scotia on Friday. "I can't really get into the details of that."

Gregg said the company believes some information may have been published on the dark web — part of the internet that requires special software to access, and which cybercriminals can use to buy and sell data and other illicit materials — but that there has been no spread of the information to other sites.

The utility has said it did not give any money to the hackers in response to the ransom demand.

Nova Scotia Power announced publicly on April 28 that it was dealing with a cybersecurity incident it discovered three days earlier, on April 25. The company later said the actual hack had occurred more than a month earlier, on March 19. 

About 280,000 customers have been affected by the attack — about half of the utility's total customers.

Letters distributed to affected customers say the stolen information may include the customer's name, phone number, email address, mailing address, date of birth, account history, driver's licence number, social insurance number and bank account numbers.

Gregg said if a customer has not yet received a letter, he's "fairly confident" their information was not taken.

Gregg told the CBC Nova Scotia Power still doesn't know exactly which information was taken from each customer, but that about 140,000 social insurance numbers were included in the stolen data.

The federal government says people do not have to provide their SIN to sign up for utility service, except for Hydro Quebec customers.

Gregg told Information Morning Halifax that Nova Scotia Power has used social insurance numbers as a way of authenticating customers in the past, but it will no longer do that, and it will delete social insurance numbers that are on file.

Asked why Nova Scotia Power was keeping so many social insurance numbers on file long after a customer's identity had been confirmed, Gregg said, "I don't have a good answer for you for that today.

"It's an unfortunate thing. I apologize to our customers that they're in that situation, but at this point in time we need to continue the investigation."