Cyber Incident Victim: Nova Scotia Power
Date:
Apr 2025
Location:
Canada
Summary
Emera andNova Scotia Power disclosed a cybersecurity incident involving unauthorized access to parts of the company's Canadian network and servers that support certain business applications. Upon detection, they activated incident response and business continuity plans, engaged third‑party cybersecurity experts, isolated the affected systems, and notified law enforcement while maintaining normal operation of generation, transmission, distribution, the Maritime Link and the Brunswick Pipeline. The incident has not disrupted physical operations or customer service, has not affected Emera’s U.S. or Caribbean utilities, and is not expected to materially impact financial results, with IT teams working to restore the compromised systems.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 25, 2025, Emera Inc. and Nova Scotia Power detected unauthorized access into certain parts of their Canadian network and the servers that support portions of their business applications. The discovery prompted an immediate activation of their incident response and business continuity protocols. Following detection, the companies engaged leading third‑party cybersecurity experts to assist with the investigation and began actions to contain and isolate the affected servers in order to prevent further intrusion. Law enforcement officials were notified of the external threat as part of the initial response. Despite the unauthorized access, Nova Scotia Power confirmed that there has been no disruption to any of its Canadian physical operations, including generation, transmission and distribution facilities, the Maritime Link, or the Brunswick Pipeline. The utility’s ability to safely and reliably serve customers in Nova Scotia remains unaffected by the incident. Similarly, Emera’s U.S. and Caribbean utilities have experienced no impact from the cybersecurity event. Emera also stated that its Q1 Financial Statements and Management Disclosure and Analysis will be released on May 8, 2025 as planned, and that the incident is not expected to have a material impact on the company’s financial performance.
Emera’s IT team continues to work diligently with the contracted cybersecurity experts to restore the affected portions of the IT system to normal operation. The companies have not disclosed further technical details about the threat actor, the specific data accessed, or the exact systems involved beyond the general description provided. The ongoing response remains focused on containment, eradication, and recovery while maintaining communication with regulators and law enforcement.