Nova Scotia Power Ransomware Attack: Emera Says Customer Data Was Stolen and Leaked

What Happened

• Emera Inc. and its subsidiary, Nova Scotia Power, were hit by a ransomware attack in 2025.
• The utility isolated affected servers, and power service kept running.
• Customer data was stolen and later published online.
• About 280,000 customers were notified.

Intricate Cyber Threats Pose Challenges for Emera

In late April 2025, Emera and its Nova Scotia Power subsidiary said they had found unauthorized access to parts of their Canadian IT network. Power generation and delivery weren’t affected. The data was another story. Weeks later, the utility confirmed it had been hit by ransomware and that customer information had been stolen.

How Nova Scotia Power Responded

The company said it moved quickly to isolate the affected servers and brought in outside cybersecurity experts. It also notified law enforcement and regulators. Nova Scotia Power said it did not pay a ransom, and in May 2025 the attackers published the stolen data on the dark web.

Containment and Investigation

The investigation found that the attackers had access to systems from around March 19, 2025, more than a month before the intrusion was spotted. That gap matters. Stolen details included names and addresses along with billing history, and for some customers driver’s licence numbers, Social Insurance numbers or bank account numbers. The company offered free credit monitoring.

What It Means for Utilities

The attack fits a broader pattern of criminals going after utilities. Energy companies hold a lot of customer data. They also run systems that people can’t live without, which makes them attractive targets for extortion.

Fallout

Canada’s federal privacy commissioner opened an investigation into the breach. Customers were left to watch for fraud and phishing that used their stolen details. For utilities, the lesson is that keeping the lights on isn’t enough. Customer data needs the same protection as the grid.

Lessons for the Utility Sector

Utilities are part of the backbone of national infrastructure. Defend both sides.

Sharing Threat Information

Faster threat detection and information sharing among utilities could shorten the time attackers go unnoticed. In this case, the attackers had several weeks inside before anyone noticed them.

Takeaways

Nova Scotia Power kept the power on, but it couldn’t keep its customers’ data safe. Long dwell times and data theft are now standard parts of ransomware attacks. Utilities should assume they’ll be targeted. They need to find intruders fast, and they need to protect the records they hold, because a quick response after the fact doesn’t undo a leak.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.