HALIFAX – Nova Scotia Power's CEO, Peter Gregg, recently disclosed that a significant cybersecurity breach may have resulted in the theft of up to 140,000 social insurance numbers from its customers. This incident occurred as a result of a ransomware attack that compromised customer records, affecting around 280,000 Nova Scotia Power customers, which constitutes more than half of the utility's total clientele.
In an interview conducted at the utility's Halifax headquarters, Gregg explained that the utility collected social insurance numbers to verify identities, noting that these identifiers are crucial for distinguishing between customers who share common names. The CEO emphasized the importance of these numbers in ensuring accurate customer service interactions.
Despite the utility's justifications for collecting such sensitive data, cybersecurity expert Claudiu Popa expressed skepticism regarding the necessity of storing social insurance numbers for authentication. Popa, who is also the founder of the non-profit KnowledgeFlow, pointed out that there are alternative and less risky methods for verifying customer identities without relying on one of the most confidential pieces of information that individuals possess.
According to Popa, government guidelines clearly discourage the use of social insurance numbers for identity verification, stating that these numbers should only be shared when legally mandated. He further warned that the misuse of social insurance numbers can facilitate various forms of fraud, including unauthorized access to government benefits and tax refunds, highlighting the severe consequences of such a data breach.
In response to concerns about the breach, Gregg clarified that customers were not required to provide their social insurance numbers and that their submission was voluntary. However, the breach, which was first reported in late April, raised alarms, especially since the initial detection of unauthorized access occurred in mid-March.
Popa criticized Nova Scotia Power for its lack of communication and the need for more precise information regarding the scope of the data breach and the specific personal information that may have been stolen. He suggested that customers should receive explicit warnings about the potential ramifications of the breach on their personal security.
Gregg assured the public that Nova Scotia Power is actively investigating the incident, working closely with IT staff and cybersecurity consultants. As the investigation progresses, he stated that further updates will be provided to customers once more definitive information is available. Gregg emphasized a cautious approach, committing to communicate verified facts rather than speculation about the incident.
The incident raises important questions about data security within utility companies and the extent to which sensitive information is collected and stored. The reliance on social insurance numbers for customer verification has drawn scrutiny, prompting experts to advocate for the adoption of safer practices to protect customer data and mitigate the risks of identity theft and fraud.
This breach underscores the urgent need for utilities and other organizations to re-evaluate their data handling policies and invest in robust cybersecurity measures to safeguard customer information against increasingly sophisticated cyber threats.
