BlastWaveBlastWaveHACKOPEDIA
Hackopedia • File 032
Nova Scotia, Canada

Nova Scotia Power Ransomware Attack (2025)

Volume 2Energy edition2025Last verified 17 sources, 14 primaryAttacker undisclosed

In April 2025 ransomware took down Nova Scotia Power’s business network. The grid never flickered and the meters kept counting, but their readings could not reach the utility. Estimated bills ran for eleven months.

Some entries in this book are about losing control. This one is about losing sight. Ransomware went off inside Nova Scotia Power’s business network after thirty seven days of quiet access. Generation, transmission and distribution were not disrupted, and the meters kept recording accurately. What died was the path between them and the utility: in its own words, the meters “have not been able to communicate that data to our systems.” Estimated bills followed for eleven months.

The utility deserves credit: it read meters by hand, suspended late fees and kept the lights on. The design lesson is where the meters’ voice ran. It ran through the same estate the attacker owned, so losing the office meant losing the readings. In many smart meter systems that path also carries commands. Nothing here says anyone reached one. That it could have carried more than silence is BlastWave’s analysis of the category, not a disclosed fact.

What is not known: Nobody has published which link in the metering chain failed: the utility’s filings say only that meter data integration was disrupted. The ransomware family and the group are undisclosed; the chief executive’s statement that the activity was closely associated with a Russia-based group is the victim’s belief, not an attribution. Whether stolen data was published is contested between the utility’s May 2025 update and the privacy commissioner’s record.

Recommendation

  1. Move collection out of the office The systems that gather meter and plant data sit on their own network, so ransomware in the office cannot take the readings with it.
  2. Remove standing credential reach No office account, domain administrator included, reaches the metering path, the plant historian or their backups. Keep backups nothing online can delete.
  3. Make measurement read one way Readings leave one way; commands to meters travel a separate, named route. Keep the manual read staffed, so losing the link costs estimates, never control.
The Nurses' Station
Podcast · Joe and Cam · 8:59
Nova Scotia Power Short
Video · 60 to 90 seconds

Sources: Emera and NS Power, 28 Apr 2025; NS Power monthly updates to the Energy Board, M12273; OPC Canada compliance letter, 25 Mar 2026; Emera 2025 Annual Report; Energy Board M12600 letter, 10 Dec 2025. Full list with links.

Soft Spots: Commands on the metering path is BlastWave’s analysis of the category, not a fact about this utility. The failed component is never named. Data publication is contested between the utility and the privacy commissioner.

The full record

Every claim numbered to its source. Last updated .

Ransomware in the business network of Nova Scotia's electric utility: the grid kept running, the meters kept measuring, and their readings could not reach the utility for eleven months. What is verified, what is only reported, and what is still unknown.

Summary

In April 2025, ransomware hit the business network of Nova Scotia Power, the province's electric utility in Canada. The utility and its parent Emera said generation, transmission and distribution were not disrupted. The meters kept recording, but their readings could not reach the utility, so most bills were estimated until 31 March 2026. The attacker remains undisclosed.2,9

Timeline of the Nova Scotia Power cyber incident

Every date is tied to a source. Press reporting appears only as evidence of what was said.

  1. CBC News reports that Nova Scotia Power has asked its regulator to approve $6.8 million for cybersecurity upgrades, some of it already spent in 2023 and 2024.10
  2. An employee visits a website compromised with SocGholish (FakeUpdates) and clicks a link in a pop-up, installing malware, according to the utility's account in its compliance letter.1
  3. Reconnaissance and credential harvesting. From on or around 8 April the attacker moves laterally using accounts with domain administrator privileges.1
  4. Data is exfiltrated from on-premises network files and cloud storage.1
  5. The attacker uses harvested credentials to destroy backups and deploy ransomware. Employees report that certain applications are not functional. From this date the meters cannot communicate their readings to the utility's systems.1,9
  6. Emera and Nova Scotia Power disclose the incident and state there is no disruption to generation, transmission or distribution.2
  7. The utility says data was accessed on or around 19 March and later taken.9
  8. The utility confirms a "sophisticated ransomware attack," says no payment has been made, and says the threat actor has published stolen data.9
  9. The utility says the meters kept gathering accurate data but "have not been able to communicate that data to our systems."9
  10. The Nova Scotia Energy Board sets out the reports required in its cyber incident inquiry, matter M12273, whose scope includes communication with customers "such as AMI meters."11
  11. In its second monthly update to the Energy Board, the utility says its ability to deliver power was not affected and that the incident disrupted billing, online self-service and meter data integration.4
  12. Monthly update 3: only meter data up to 31 March 2025 will be available for 2025 analysis; the plant information (PI) data system environment is being re-established.5
  13. Chief executive Peter Gregg tells a legislature committee of "a high degree of confidence" that the activity was "closely associated with a Russia-based threat actor group."8
  14. At the Premier's request the Energy Board opens a new matter on estimated billing, M12600, and writes to the Premier on 10 December.12
  15. First bills using data from reconnected smart meters go out.7
  16. Monthly update 5: over 400,000 meters delivering data by end of January; connections established for several generating assets.13
  17. Monthly update 6: 84.6% actual reads in January 2026 and more than 450,000 meters delivering data by end of February.7
  18. The privacy commissioner publishes the utility's compliance letter, signed 18 March, and a news release. The same day, the Energy Board's 2026 rate decision addresses billing from meter data.1,6,14
  19. The utility says meter connections to its billing system have been restored and estimated bills are back to around 2% or less.9
  20. The Energy Board asks for the utility's Cybersecurity Incident Report, dated 22 December 2025, to be refiled with fewer redactions.15
  21. The utility announces that late fees, not charged since April 2025, will return on 1 October 2026.9
  22. The Energy Board's public hearing begins, with the utility participating.9

Key facts and their status

Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.

QuestionWhat the record saysStatus
Was the grid disrupted?No disruption to generation, transmission or distribution, per Emera and Nova Scotia Power2,4Verified (company statement)
Did the meters keep working?Yes. They "continued to function and gather accurate energy usage data"9Verified
What failed between the meters and billing?Filings say meter data integration was disrupted; the specific component has not been named4Undisclosed
How did the intruder get in?A website compromised with SocGholish, visited on or around 19 March 2025, per the utility's account1Verified (utility's own account)
How long was the intruder inside?About 37 days, 19 March to 25 April 20251Verified (utility's own account)
Which ransomware?Not named in any primary documentUndisclosed
Who did it?No government attribution and no public claim; the chief executive has stated a belief8Undisclosed
Was a ransom paid?No, per the utility, 23 May 20259Verified (company statement)
Whose data was taken?Approximately 375,000 current and 540,000 former customers, about 915,000 individuals1,6Verified
Was the stolen data published?The utility said yes in May 2025; the March 2026 compliance letter says no evidence has yet emerged1,9Contested
Incident costNot disclosed. Emera: "not expected to have a material impact"3Undisclosed
When was billing from meters restored?Meter connections to billing restored by 31 March 2026, per the utility9Verified (company statement)

Was Nova Scotia's power grid attacked?

No disruption to generation, transmission or distribution is on the record. Three days after discovery, Emera and Nova Scotia Power said:

"There remains no disruption to any of our Canadian physical operations, including at Nova Scotia Power's generation, transmission and distribution facilities, the Maritime Link or the Brunswick Pipeline."
Emera Inc. and Nova Scotia Power, joint statement, 28 April 20252

Emera has repeated that there was no disruption to its Canadian physical operations in its filings since, and the utility told the Energy Board in October 2025 that its ability to deliver power to customers was not affected.3,4 The meters themselves kept working. The utility said on 8 July 2025 that they had "continued to function and gather accurate energy usage data."9

There was a second loss of visibility, on the plant side. In November 2025 the utility reported it was "re-establishing the Plant Information (PI) data system environment to begin reconnection to plants and systems."5 In February 2026 it said connections had been established for several generating assets, "improving the visibility of plant output and operational oversight."13 The filings describe visibility, not plant control. Reading the PI loss as a second loss of measurement rather than of control is BlastWave's reading of those filings, not a disclosed fact.

Why did Nova Scotia Power customers get estimated bills?

Because the meters' readings could not reach the utility's systems, not because the meters stopped. The utility put it this way on 8 July 2025:

"However, due to the cyber incident, the meters have not been able to communicate that data to our systems."
Nova Scotia Power, Cyber Incident Updates, 8 July 20259

In its filing to the Energy Board the utility wrote: "While meters have continued to accurately record electricity usage, the Incident disrupted customer billing processes, online self-service functions, and meter data integration."4 That is as specific as the filings get. Which link in the metering chain failed has not been published. The phrase "the communications link" comes from Global News reporting of the chief executive's remarks on 25 November 2025, not from a filing.16 The utility's Cybersecurity Incident Report to the Energy Board, dated 22 December 2025, was filed with redactions, and the Board asked in April 2026 for it to be refiled with fewer.15

The fallback worked, slowly. Most customers received estimated bills, supplemented by manual meter readings.4 Only meter data up to 31 March 2025 was available for 2025 analysis.5 The first bills from reconnected smart meters went out on 23 December 2025; January 2026 had 84.6% actual reads; more than 450,000 meters were delivering data again by the end of February 2026.7 On 31 March 2026 the utility said: "Meter connections to our billing system have been restored," with estimates back to around 2% or less.9 Late fees were not charged from April 2025, and the utility announced they would return on 1 October 2026.9

One operational detail is narrower than it can sound. The utility's October 2025 filing says that from 25 April to 5 August 2025, "ECC dispatched load in real time, without NSP Marketing providing PHP with a real-time dispatch schedule."4 On our reading, the missing schedule concerns one customer account (PHP), not the system's dispatch. The control center kept dispatching.

"Eleven months" is a span, not a uniform state: it runs from 25 April 2025 to the 31 March 2026 restoration statement, with manual reads throughout and reconnected-meter bills from late December 2025.

How did the attackers get into Nova Scotia Power, and what did they take?

Through a compromised website and a pop-up, by the utility's own account. The compliance letter the federal privacy commissioner published in March 2026 states that on or around 19 March 2025 an employee visited a website compromised by SocGholish (FakeUpdates) malware and clicked on a link in a pop-up.1 Between 8 and 22 April the attacker carried out reconnaissance and credential harvesting, and from on or around 8 April moved through the network using accounts with domain administrator privileges. Data was exfiltrated from on-premises network files and cloud storage from 23 to 25 April. On 25 April the attacker "used credentials acquired during its previous credential harvesting activities to destroy backups and deploy ransomware."1

This is primary as to what the utility said. No independent forensic report is public. The breach was found because "Nova Scotia Power's employees reported that certain applications were not functional."1

Personal data of about 915,000 individuals. The privacy commissioner's record is approximately 375,000 current customers and approximately 540,000 former customers.1,6 Emera reports that Nova Scotia Power served approximately 565,000 customers at the end of 2025, so the right noun is individuals, not customers.3 SecurityWeek reported in May 2025 that the utility was sending 280,000 breach notifications, an earlier and different measurement; the two figures are not a range.17

Whether the stolen data was published is contested between two primary documents. On 23 May 2025 the utility said: "We have learned that the threat actor has published data that was stolen from our systems."9 The compliance letter, signed 18 March 2026, says "no evidence has yet emerged that this sensitive data has been made public or sold."1 We print both and pick neither.

Who was behind the Nova Scotia Power attack?

Undisclosed. No government has attributed the attack, and no group has been found publicly claiming it. The only statement is the victim's own belief, given by the chief executive to a Nova Scotia legislature committee and published by the utility:

"Based on expert assessments and intelligence, there is a high degree of confidence that the activity was closely associated with a Russia-based threat actor group."
Peter Gregg, President and CEO, Nova Scotia Power, opening remarks to the Natural Resources and Economic Development Committee, 25 November 20258

That is a belief with its hedges intact: "high degree of confidence," "closely associated," "a" group. It names no group and is not an attribution. Commentators have linked the SocGholish loader to specific sanctioned groups. Adjacency is not attribution: no primary document names who ran this intrusion.1,8

The utility did not pay. On 23 May 2025 it said: "No payment has been made to the threat actor. This decision reflects our careful assessment of applicable sanctions laws and alignment with law enforcement guidance."9

How much did the Nova Scotia Power cyberattack cost?

No incident cost has been disclosed. Emera's 2025 Annual Report says the incident is "not expected to have a material impact on the Company's financial position or results of operations," and that Emera "maintains cyber insurance coverage and is working with its insurer on the claims process."3

The $6.8 million figure that circulates is not a cost. CBC News reported on 10 March 2025 that the utility had asked its regulator to approve $6.8 million for cybersecurity upgrades, with just over $285,000 already spent in 2023 and $1.4 million in 2024 and the rest for 2025 and 2026.10 That report ran about a week before the privacy record's date for initial access. It is security spending, partly already made, and on the record the request predates the incident.

What is still not known about Nova Scotia Power

  • Which link in the metering chain failed. The filings say only that meter data integration was disrupted, and the utility's incident report to the Energy Board was filed with redactions.4,15
  • The ransomware family.
  • Who carried out the intrusion. The chief executive's statement is the victim's belief, not an attribution.8
  • The incident's cost.
  • Whether the stolen data was published. The utility's May 2025 update and the privacy commissioner's record disagree.1,9
  • Any Energy Board finding from the hearing that began in August 2026; none found as of late September 2026.
  • The filing date and full scope of the $6.8 million cybersecurity request, which is known here from press reporting.10
  • Who supplied the utility's smart meters. No record cited here identifies the vendor.

Claims about Nova Scotia Power the record does not support

Widely repeated claimWhat the record says
"The cyberattack disconnected Nova Scotia Power's meters."The meters "continued to function and gather accurate energy usage data." What failed was the path that carried their readings to the utility.4,9
"The attack cost Nova Scotia Power $6.8 million."The $6.8 million is a request for security upgrades reported on 10 March 2025, before the privacy record's date for initial access, and partly already spent. No incident cost has been disclosed.3,10
"The group behind the SocGholish loader carried out the attack."Only the loader is named in a primary document. No government has attributed the attack and no primary document names a group.1,8
Press renderings of the CEO's remarks: "the Russia-based threat actor group."The utility's published remarks say "a Russia-based threat actor group," with "a high degree of confidence" that the activity was "closely associated" with it. A belief, not an attribution.8

What have regulators done about the Nova Scotia Power incident?

Energy Board inquiry, M12273. The Nova Scotia Energy Board, which now handles the energy matters formerly before the Nova Scotia Utility and Review Board, opened a cyber incident inquiry whose scope includes the "operation of the grid and its communication with customers such as AMI meters."11 The utility filed monthly updates to the Board through the recovery.4,5,7,13

Estimated billing, M12600. After the Premier wrote to the Board, it opened a new matter on estimated billing in December 2025. The Board's 10 December letter restates the Premier: "since the cyber-attack at NS Power over eight months ago, the utility has relied on estimated billing."12 That sentence is the Premier's, quoted by the Board, not a Board finding.

Rate decision. In Decision 2026 NSEB 8 on the 2026 General Rate Application, dated 25 March 2026, the Board said bills at the new rates should use meter (AMI) data rather than proration unless the utility shows it cannot, and noted that a consultant was unable to obtain some data because of the cybersecurity incident.14

Privacy. The Office of the Privacy Commissioner of Canada published the utility's compliance letter and a news release, "Nova Scotia Power commits to strengthening security measures," on 25 March 2026.1,6

Hearing. The Energy Board's public hearing began on 18 August 2026.9 As of late September 2026 we found no Board decision from it.

BlastWave analysis: measurement lost, control not

Analysis, not a disclosed fact

Some entries in this book are about losing control. This one is about losing sight. On the record, this was an IT compromise with no physical operation halted and no OT compromise, whose consequence was measurement rather than control: the meters kept recording, and the path that carried their readings ran through the same estate the attacker owned, so losing the office meant losing the readings. It is the measurement twin of Viasat, where turbines lost their remote eyes and kept generating. The utility deserves credit for the fallback: people who could read a meter by hand, a control center that kept dispatching, late fees suspended, and the lights kept on while it rebuilt.4,9

In many smart meter systems the same path that carries readings also carries commands, remote disconnect among them. Nothing in this record says anyone reached such a function at Nova Scotia Power. That the path could have carried more than silence is BlastWave's analysis of the category, not a disclosed fact about this utility, and it is why the entry is in the book.

How BlastWave removes the paths an attacker uses to reach OT

Listen and watch

Podcast: “The Nurses' Station” (8:59). Joe Baxter and Cam Cullen on why losing the meters' voice was a loss of measurement, not of control.

Video: Nova Scotia Power Short (60 to 90 seconds).

Frequently asked questions

What happened in the Nova Scotia Power cyberattack?

On 25 April 2025 ransomware was deployed in Nova Scotia Power's business network, after an intrusion that began on or around 19 March 2025, according to the utility's compliance letter published by the privacy commissioner. Emera and the utility said generation, transmission and distribution were not disrupted. The meters kept recording, but their readings could not reach the utility, so most customers received estimated bills until meter connections to billing were restored by 31 March 2026.

Did the Nova Scotia Power cyberattack affect the power grid?

No disruption to the grid is on the record. On 28 April 2025 Emera and Nova Scotia Power said there was no disruption to generation, transmission or distribution, and the utility told the Nova Scotia Energy Board in October 2025 that its ability to deliver power was not affected. The meters also kept working; the utility said on 8 July 2025 that they continued to gather accurate usage data.

Why were Nova Scotia Power bills estimated for so long?

The utility said on 8 July 2025 that its meters kept gathering accurate data but could not communicate it to the utility's systems because of the cyber incident. Its filings say meter data integration was disrupted without naming the failed component. It used estimated bills supplemented by manual reads, sent the first bills from reconnected meters on 23 December 2025, and said meter connections to billing were restored on 31 March 2026.

How did hackers get into Nova Scotia Power?

According to the utility's compliance letter, published by the Office of the Privacy Commissioner of Canada in March 2026, an employee visited a website compromised with SocGholish (FakeUpdates) malware on or around 19 March 2025 and clicked a link in a pop-up. The attacker then harvested credentials, moved laterally with domain administrator accounts, took data, and on 25 April destroyed backups and deployed ransomware. No independent forensic report is public.

Who was behind the Nova Scotia Power attack?

No government has attributed the attack and no group has been found publicly claiming it. On 25 November 2025 chief executive Peter Gregg told a Nova Scotia legislature committee, in remarks the utility published, that there was a high degree of confidence the activity was closely associated with a Russia-based threat actor group. That is the victim's stated belief, not an attribution, and it names no group.

How many people were affected by the Nova Scotia Power data breach?

The Office of the Privacy Commissioner of Canada said in March 2026 that personal information of approximately 375,000 current and 540,000 former Nova Scotia Power customers was affected, about 915,000 individuals. Emera reports the utility served approximately 565,000 customers at the end of 2025, so the figure counts individuals, not current customers. Whether the stolen data was published is contested between the utility's May 2025 update and the commissioner's record.

Did Nova Scotia Power pay the ransom, and what did the attack cost?

The utility said on 23 May 2025 that no payment had been made, citing its assessment of sanctions laws and law enforcement guidance. No incident cost has been disclosed. Emera's 2025 Annual Report says the incident is not expected to have a material impact and that an insurance claim is in progress. The $6.8 million often quoted is a cybersecurity upgrade request reported by CBC in March 2025, before the privacy record's date for initial access.

Viasat KA-SAT / EnerconThe control-side twin: there turbines lost remote monitoring and control and kept generating; here the meters lost their path home and kept measuring.American WaterThe nearest shape: there the company chose to take billing offline as a precaution; here nobody chose, and the measurement path stayed dark for eleven months.ItronThe metering vendor's own incident. The pairing is thematic only: nothing in either record connects Itron to Nova Scotia Power's meters.

Sources

Primary sources are the utility's and Emera's own dated statements and filings, the Nova Scotia Energy Board record in matters M12273, M12600 and M12451, and the Office of the Privacy Commissioner of Canada's published compliance letter and news release. Press is cited only as evidence of what was said or reported.

  1. RegulatorOffice of the Privacy Commissioner of Canada, compliance letter by Nova Scotia Power, signed at Halifax 18 March 2026, published 25 March 2026. priv.gc.ca
  2. CompanyEmera Inc. and Nova Scotia Power, "Emera and Nova Scotia Power Responding to Cybersecurity Incident," 28 April 2025. nspower.ca · businesswire.com
  3. Company filingEmera Inc., 2025 Annual Report (Management's Discussion and Analysis and financial statements). PDF · emera.com
  4. Company filingNova Scotia Power, Monthly Update 2 to the Nova Scotia Energy Board, matter M12273 (cyber incident inquiry), 1 October 2025. PDF
  5. Company filingNova Scotia Power, Cyber Incident Monthly Update 3 to the Nova Scotia Energy Board, matter M12273, 3 November 2025. PDF
  6. RegulatorOffice of the Privacy Commissioner of Canada, "Nova Scotia Power commits to strengthening security measures," news release, 25 March 2026. priv.gc.ca
  7. Company filingNova Scotia Power, Monthly Update 6 to the Nova Scotia Energy Board, matter M12273, 6 March 2026. PDF
  8. CompanyNova Scotia Power, "Natural Resources and Economic Development Committee: Opening remarks," Peter Gregg, President and CEO, to the Nova Scotia legislature's Standing Committee on Natural Resources and Economic Development, 25 November 2025. nspower.ca
  9. CompanyNova Scotia Power, Cyber Incident Updates page, dated updates from 28 April 2025 to 17 August 2026, including 14 May 2025, 23 May 2025, 8 July 2025, 31 March 2026, 15 July 2026 and 17 August 2026. nspower.ca
  10. PressCBC News, "Nova Scotia Power asks regulator to approve $6.8M for cybersecurity upgrades," 10 March 2025, as syndicated by Yahoo News Canada. Cited as evidence of what was reported. Yahoo News Canada (CBC syndication)
  11. RegulatorNova Scotia Energy Board, matter M12273, letter to Nova Scotia Power regarding reports required, 14 July 2025.
  12. RegulatorNova Scotia Energy Board, matter M12600, Chair's letter to the Premier of Nova Scotia, 10 December 2025 (opening a new matter on estimated billing; restates the Premier's letter). PDF
  13. Company filingNova Scotia Power, Monthly Update 5 to the Nova Scotia Energy Board, matter M12273, 5 February 2026. PDF
  14. RegulatorNova Scotia Energy Board, Decision 2026 NSEB 8, matter M12451, Nova Scotia Power 2026 General Rate Application, 25 March 2026, paragraphs 23 and 51.
  15. RegulatorNova Scotia Energy Board, matter M12273, letter regarding updated documents, 7 April 2026 (Cybersecurity Incident Report dated 22 December 2025, Exhibit N-3(C), to be refiled with redactions reduced). PDF
  16. PressGlobal News, report of Peter Gregg's remarks to the Nova Scotia legislature committee, 25 November 2025. Cited as evidence of what was said.
  17. PressSecurityWeek, "Nova Scotia Power Confirms Ransomware Attack, 280k Notified of Data Breach," May 2025. Cited as evidence of what was reported.

Cite this page

BlastWave. “Nova Scotia Power Ransomware Attack (2025): What Is Verified.” Hackopedia, Volume 2, FILE 032. Last verified 28 September 2026. https://hackopedia.blastwave.com/energy/nova-scotia-power-2025/

Revision history

DateChange
6 Oct 2026Numbered FILE 032 in Hackopedia Volume 2, in the Energy edition.
28 Sep 2026Hand-check at source: the utility's November 2025 monthly update to the Energy Board located and re-read, confirming that only meter data up to 31 March 2025 was available for 2025 analysis and that the plant information environment was being re-established.
26 Sep 2026Full validation against the privacy commissioner's compliance letter, the utility's dated updates and Energy Board filings, Emera's 2025 Annual Report and the Energy Board's letters. The chief executive's November 2025 statement is cited to the utility's own published remarks. Narrowed the real-time dispatch point to the filing's own wording, which we read as concerning one customer account; confirmed that "the communications link" appears in press reporting rather than a filing, and that part of the $6.8 million request had already been spent.
24 Sep 2026Entry built from primary sources.

How Hackopedia verifies an entry

Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry