Building Resilience via Leadership in Crisis After the Breach: Analysing the Response from NS Power

Cyberattacks on utilities like Nova Scotia Power (NS Power) are not just corporate events—they are matters of public interest and, increasingly, national security. The breach that recently impacted NS Power is a stark reminder that the stakes are far higher than just operational disruption. The decision of how much to say, when to say it, and how to restore public confidence are not just communications challenges; they are strategic decisions with long-term consequences.

In today’s cybersecurity landscape, no defense is impenetrable. What distinguishes resilient organizations isn’t immunity to attack, but the integrity and transparency of their response. As NS Power works to recover from this breach, it stands at a critical crossroads—one that’s all too familiar in the energy and infrastructure sector: treat cybersecurity as a technical fix, or recognize it as a matter of public trust. If NS Power chooses the latter, and commits to meaningful transparency, it can emerge stronger than before.

Step One: Contain First—Panic Never

When a cyberattack hits, panic is the enemy of clarity. The temptation might be to scramble behind closed doors, lock everything down, and hope for the best. But that instinct, while understandable, is exactly what can exacerbate the damage. It leads to hasty decisions, missed opportunities, and sometimes, a deeper crisis.

In NS Power’s case, the breach was detected on April 25, 2025. Immediately, the company activated its incident response and business continuity protocols. They didn’t wait for more information or "hope it wasn’t too bad." The breach was contained swiftly, and third-party cybersecurity experts were brought in to isolate and prevent further damage. This is the first and most important step: containment.

A well-prepared company understands that the real damage of a cyberattack is not just technical—it’s reputational, operational, and legal. The cost of a slow or confused response can be far higher than the attack itself. The most important thing in the first hours is to act decisively.

Step Two: Communicate Early, Even If Incomplete

The instinct to remain quiet after a breach is understandable—companies often fear that saying too much will worsen the situation. But silence, in this case, is a strategic liability.

NS Power chose to communicate early with the public, issuing press releases and sharing updates via social media. While the full scope of the breach wasn’t immediately clear, and the details were still being gathered, the decision to provide information was critical. Too many companies, faced with similar incidents, opt for silence, hoping that it will shield them from scrutiny. However, in the case of a cyberattack, silence only fuels speculation and can lead to a loss of public trust.

Transparency, even in the face of uncertainty, builds trust. People are more forgiving of breaches if they feel that the company is being honest and taking steps to address the situation. What customers won’t forgive is dishonesty or a lack of communication. NS Power’s decision to keep stakeholders informed throughout the incident shows a level of accountability that should be the gold standard.

Step Three: Investigate Thoroughly, Rebuild Honestly

Once the immediate threat is contained, the heavy lifting begins. The focus must now shift to the investigation: What exactly happened? How did the attackers gain access? What data or systems were compromised? Answering these questions is critical, but so is acknowledging the hard truth: many organizations don’t invest enough in cybersecurity until it’s too late.

For NS Power, this phase is just beginning. The company must continue working with cybersecurity experts to trace the intruder’s steps and close any vulnerabilities that were exploited. The findings should be documented, shared, and acted upon. But this step is not just about fixing technical gaps—it’s about rebuilding trust.

NS Power has an opportunity here to demonstrate accountability. A thorough, transparent post-incident report will go a long way in reassuring the public and its customers. The investigation and restoration phase is also an opportunity for the organization to engage in self-reflection. Leadership must ask: "Did we do enough to prevent this?" The answer might not be comfortable, but it’s necessary to move forward stronger.

Step Four: Use the Breach as a Culture Change Moment

Every breach, no matter how damaging, should be a catalyst for change. Cybersecurity isn’t just the responsibility of the IT department. It’s an enterprise-wide issue that demands attention from the top down. For NS Power, this moment must mark the beginning of a deeper cultural shift. Cybersecurity awareness, risk management, and data protection need to be part of the DNA of every team, from the C-suite to the front lines.

The best companies understand that cybersecurity is not just a technical issue, but a continuous cultural challenge. It requires constant investment, vigilance, and a commitment to training staff at all levels. By treating this breach as a lesson for improvement, NS Power has the potential to not only strengthen its technical defenses but also instill a company-wide culture of proactive cybersecurity.

Let’s be clear: in today’s digital age, a cyberattack is no longer a question of if—it’s a question of when. And what separates resilient organizations from those that suffer long-term damage isn’t the absence of attacks, but the way they respond to them.

Cybersecurity Is a Trust Issue—Not Just a Tech Issue

As of now, NS Power has taken many of the right steps: detection, containment, public communication, and collaboration with law enforcement. But the ultimate measure of success will be how they handle the investigation, the restoration process, and the critical task of rebuilding trust. NS Power must be transparent, share their findings, and most importantly, show how they will prevent future breaches.

The ideal response to a cyberattack is not about perfection—it’s about preparation, communication, and leadership under pressure. It’s about having the systems, the processes, and the culture in place to handle a breach when it inevitably occurs. And it’s about showing the public that you are in control, learning from the incident, and emerging stronger as a result.

That’s what will ultimately define NS Power’s recovery—not just the technical response, but the way it communicates, learns, and evolves. In the end, organizations that face cyber threats with transparency and accountability build stronger relationships with their customers and communities. They transform a crisis into an opportunity for growth.

And that’s the chance NS Power, and every other critical institution, must seize—not just for their own sake, but for the large number of customers who rely on them every day.