HALIFAX - Nova Scotia Power has revealed that the impact of a cyberattack in March may be more extensive than previously believed. Initially, the utility estimated that about 277,000 of its customers had personal information compromised. However, a recent report indicates that all 550,000 customers could be affected in some capacity.

The report was submitted to the Nova Scotia Energy Board, which is investigating the breach. It states, "This investigation is ongoing and has been complex given the severe nature of the cyberattack. It remains possible that all of the company’s customers may have been impacted by the cyberattack."

The stolen data includes sensitive information such as names, birth dates, email addresses, home addresses, customer account details, driver’s license numbers, and in some cases, bank account numbers and social insurance numbers. The report also notes that the utility cannot specify which individual customers have had their information accessed.

"Due to the nature of the breach and the complexity of the systems involved, and despite the company’s comprehensive investigative efforts, the data accessed … cannot be definitively identified on an individual basis," the report explains.

The breach was first detected on April 25. Nova Scotia Power contacted the RCMP and the Canadian Security Intelligence Service shortly after, and the public was informed on April 28. The report confirms that while the cyberattack did not disrupt physical operations at the utility’s facilities, it did hinder the company’s ability to automatically collect electricity usage data from smart meters.

As a result, Nova Scotia Power began issuing estimated bills based on previous usage averages in June. The report mentions that some customers received larger-than-expected bills, and the utility is working to maintain a normal billing schedule to address customer concerns.

In July, the company acknowledged that the breach also impacted former customers, but it remains unclear how many were affected. The report states, "Given the impact of the incident on the company’s systems, the information available (about former customers) … is limited."

On May 14, Nova Scotia Power announced that the consumer reporting agency TransUnion would provide the 277,000 affected customers with two years of free credit monitoring. This offer was later extended to five years for all customers. The utility has stated that customers will not incur any costs for credit monitoring due to this incident, but it has not confirmed whether affected customers will receive compensation for potential losses.