Nova Scotia Power can’t explain why hacked customer data was not deleted as planned

Nova Scotia Power officials are perplexed as to why a digital repository of nearly three decades of customer information, subsequently compromised in a cyberattack, was not automatically purged as initially scheduled. The personal data encompassing addresses, contact details, financial specifics, and social insurance numbers of hundreds of thousands of individuals was accessed in March 2025, purportedly by actors based in Russia.

The company's executive, Blake Williams, testified at a regulatory hearing that the organization possesses mechanisms for the periodic deletion of specific data, with cycles not exceeding 90 days. However, Williams admitted that the utility is uncertain as to why the file, which originated in 2021 and remained active in 2025, was not erased as planned. Williams posited that if the data had been disposed of according to the intended schedule, the attackers would not have had access to the information.