Personal data stolen in N.S. Power breach? Here's how to protect yourself from fraud

CBC

26-05-2025

A recent ransomware attack on Nova Scotia Power has affected over half of its customers, raising concerns about the potential for identity fraud. The utility confirmed that an unauthorized third party stole data from some 280,000 customers and that it has been published online.
The data that was stolen could include customers' names, phone numbers, email addresses, mailing addresses, date of birth, account history, driver's licence numbers, social insurance numbers and bank account numbers.
Jeff Horncastle, a client and communications outreach officer with the Canadian Anti-Fraud Centre and the RCMP, says it's the customer's responsibility to ensure they don't become a victim of identity fraud — and that can feel overwhelming. Horncastle shared tips with CBC Radio's Information Morning Nova Scotia on what customers should do to protect themselves going forward.
This interview has been edited for length and clarity.
How serious would you say this is for the average Nova Scotia Power customer who's affected?
There's so many different ways where we can be a victim of identity theft that we really have to be careful and make sure that we're not victims of identity fraud at the end of the day.
The difference between identity theft and identity fraud is that identity theft is when you're the victim of the breach, like in this case. Identity fraud is when your personal information is actually used to apply for credit with your name. The fraudsters may apply for credit cards, they may try to access their bank accounts, they may apply for cellphones. What you want to do is take one step at a time.
It's our understanding that a lot of these companies [like Nova Scotia Power] provide credit monitoring with one credit reporting agency. It is very important to contact both Equifax and TransUnion to put a fraud alert on your file.
What that does is that if anybody does apply for credit with your information, you'll get a phone call to ask if it was actually you that applied for the credit before it gets processed. Now, going down the list, you want to contact your financial institution, let them know that you've been part of a breach.
Is there something that the bank can do?
In a lot of cases, if you don't have multi-factor authentication on your accounts, then it may be something that you want to consider doing. That's something that each financial institution has the ability to do to protect your account. It's very important to contact your financial institutions and your credit card companies.
If you have the two-factor authentication set up, should you be resting easy here or could you be a bit concerned about whether somehow that's been compromised as well?
You shouldn't necessarily rest easy, no. You should still contact your financial institution and find out what you should be doing.
Maybe change your passwords for your email address. Since all your accounts are linked to your email, you want to make sure that your email is at least protected. And if you're using the same password for all your accounts, make sure that you're using a unique password for every account.
Of course you want to contact the CRA [Canada Revenue Agency] as well because we see that there could be false income taxes filed or fraudsters could be trying to apply for benefits through the CRA or Service Canada. We recommend that you contact both those agencies as well.
Given that so much personal information is out there, how much can you trust a phone call that you may be getting from someone, including TransUnion or Equifax?
You're probably not going to get a phone call from Equifax or TransUnion. With that being said, fraudsters can try to use that personal information that they gain from the breach to try to fraud you.
They may pretend that they're your bank, they may pose as the government agency.
Always make sure that you're making the outgoing call to whatever agency or company in question, and make sure that you're calling the official phone number. If you do get an incoming call, there's no way to confirm 100 per cent who you're communicating with.
And if the worst were to happen and some of these customers become victims of identity fraud, what do you do in that scenario and what protection is there for that customer?
The credit monitoring is good, but the fraud alerts are really what protects victims of the breach from being a victim of identity fraud. Make sure that you have those fraud alerts on with both credit agencies. That way you'll be protected from loans being opened with your name.
In most cases, victims are not responsible for accounts that are fraudulently opened. But it can become a huge headache, so that's why you want to make sure that you're protected from that occurring.
Do you need to be at all worried about using e-transfers or paying bills electronically through those accounts now, given that the emails are out there?
As long as you have a strong password, your email technically should be OK. For questions related to e-transfers and bank accounts, that's something that the victim's financial institution would be able to [address].