TrueNorthSec

Defending Canada’s Digital Frontier

Author: Darius Dogaru

  • Emera, Nova Scotia Power plagued by cybersecurity breach

    Emera and Nova Scotia Power say they are responding to a cybersecurity incident.

    They said in a news release Monday that someone gained unauthorized access to parts of their Canadian network and servers supporting their business applications. The breach was discovered April 25, according to the release.

    The news release did not say what information was accessed, or what, if anything, was done with it.

    Based on expert advice, including law enforcement at all levels, we made the decision to … we have not paid,” he said.

    Cybersecurity experts are now helping Nova Scotia Power, Gregg said.

    While cybersecurity protections are in place at the utility, Gregg said there is now an active investigation to see what can be learned from the breach and tighten defences in the future.

    The operations side of the business was not affected, he said.

    Nova Scotia Power and parent company Emera announced in late April that they were dealing with a cybersecurity incident discovered on April 25. The company’s investigation later revealed the data was accessed more than a month earlier, on or around March 19, and was later stolen.

    Nova Scotia Power has confirmed it is the victim of a ransomware attack and that the hackers who stole data have published it on the dark web.

    Peter Gregg, the utility’s president and CEO, said Friday it is believed 280,000 customers have had their information stolen — more than half of the customers in the province.

    Gregg said the attack comes from a “very sophisticated threat actor.” He said there is a ransom request but none has been paid.

  • Toronto Public Library Ransomware

    The Toronto Public Library is experiencing ongoing technical outages due to a Black Basta ransomware attack.

    The Toronto Public Library (TPL) is Canada’s largest public library system, giving access to 12 million books through 100 branch libraries across the city. The library system has 1,200,000 registered members and operates on a budget that surpasses $200M.

    The library warned that public computers and printing services are also unavailable.

    The Toronto Public Library says that there is no evidence that the personal information of staff or customers has been compromised and that they are actively investigating the incident with law enforcement and third-party cybersecurity experts.

    “TPL has proactively prepared for cybersecurity issues and promptly initiated measures to mitigate potential impacts,” reads a notice on a temporary library website hosted on Typepad.

    “We have engaged with third-party cybersecurity experts to help us in resolving this situation. We do anticipate though that it may take several days before all systems are fully restored to normal operations.”

    According to a TPL employee, the attack occurred overnight on October 27th, impacting numerous services Saturday morning.

    The attack did not impact phones and had limited impact on email, with those logged into their Office 365 accounts still able to access them. However, employees who were not currently logged into email were no longer able to access the system.

    All other internal systems were shut down after the attack as a precaution to prevent the spread of the malware.

  • RCMP Data Breach

    RCMP Data Breach

    Techish

    In February 2025, a cyber attack compromised sensitive systems within the Royal Canadian Mounted Police (RCMP). Investigations pointed to a targeted supply chain attack exploiting third-party software vulnerabilities. The consequences included operational disruption, loss of public confidence, and significant remediation costs.

    When IT leaders think of cyberattacks, they think of their customers’ sensitive data, but all too often it’s the employees that get compromised. The internet exploded in November of last year when the Canadian Government announced an investigation into a cyberattack that targeted private companies working to relocate military, federal police and foreign service members.

    Federal government employees saw their personal and financial data compromised by companies who apparently administer 20,000 federal moves annually. The data breach covered 24 years of data, so a lot of people were affected.

    One thing that stands out is that it was private enterprise serving government who got hacked. Clearly the service providers lucky enough to win coveted, high-value government contracts weren’t doing enough to ensure that data was protected.

    What does this mean to the future of RFPs to government, not to mention government expectations of service providers?

    Is there an opportunity for your organization be a standout here?

    One thing’s certain, you don’t want to be the IT executive in charge when something like this happens.