
1. Invest Nova Scotia Hack
After a hack into an employee’s email account, Invest Nova Scotia transferred approximately $573,000 to a bank account falsely portrayed as belonging to Sandpiper Ventures.
Invest Nova Scotia is now asking for a court order to require the Royal Bank of Canada (RBC) to return the money to Invest Nova Scotia.
In his application for the court order filed with the Supreme Court of Nova Scotia on July 16, Invest Nova Scotia lawyer Andrew Hill obfuscated the hack. Hill wrote that:
Invest Nova Scotia and the [unnamed] partner are parties to an agreement whereby Invest Nova Scotia is committed to making capital contributions, and the partner is entitled to making capital calls from Invest Nova Scotia.
On May 16, 2024, the partner made a capital call from Invest Nova Scotia.
On May 23, 2024, Invest Nova Scotia sent funds intended for the partner. The funds were sent by electronic funds transfer (EFT) to an RBC account.
On June 6, 2024, Invest Nova Scotia became aware that the funds had been sent to the RBC account in error. The RBC account belongs to a third party and not the partner, and the partner did not receive any portion of the funds.
RBC has advised Invest Nova Scotia that it requires a court order to return the funds.
Invest Nova Scotia states that:
(a) the funds received by RBC from Invest Nova Scotia which remain in the RBC account are held in trust by RBC for Invest Nova Scotia and
(b) Invest Nova Scotia is entitled to have the funds returned to it by RBC.
But an affidavit and accompanying exhibits filed with the court on July 24, Stephanie Corvese, a manager of digital forensics with Grant Thornton Canada, shows that the transfer was made as a result of a hack of Invest Nova Scotia employee Ferdinand Makani’s email, and that the “partner” is Sandpiper Ventures.
Makani is the controller at Invest Nova Scotia.
Sandpiper Venturers is a privately held venture capital fund that invests in women-led businesses. It was started by six well-connected women, including Amy Risley, spouse of billionaire John Risley. In 2021, the McNeil government contributed $5 million to Sandpiper Ventures; since then, Sandpiper has funded some Atlantic Canadian firms, such as Halifax-based DeNova and Newfoundland-based Swiftsure Innovations, but it has also funded firms clear across the country, such as Fable, a Vancouver-based dinnerware company, and Callia, a Winnipeg-based flower delivery company.
The $5 million for Sandpiper was first delivered to Nova Scotia Business Inc, Invest Nova Scotia’s predecessor organization, and what is left of it is now held by Invest Nova Scotia. That arrangement allows for the government agency to hold the funds and earn interest on them. When Sandpiper finds a company it wants to fund, it requests a transfer of the money from Invest Nova Scotia.
How the scam went down

On 10:32am (all times in this article are Atlantic Time) on May 16, the Thursday before the long Victoria Day holiday, Steven Carr, the Chief Financial Officer at Sandpiper, sent an email to Daisy Karasek, the Senior Manager of Finance at Invest Nova Scotia, and to Lidija Marusic, the Vice President of Business Investment at Invest Nova Scotia. Carr copied Cathy Bennett, a managing director at Sandpiper. Carr used his Sandpiper email account, [email protected]. The email had the subject line of “Sandpiper Venture Fund LP – Capital Call – (Due May 31, 2024).” In the text of the email Carr mistakenly said the funds were due on May 31, 2023.
Karasek responded to Carr, asking him to remove her from the communications and add Ferdinand Makani, who was cc’ed along with two other Invest Nova Scotia employees, Charlene Martell-Isnor, an executive assistant, and Christine Chisholm, Manager of Business Financing.
According to Corvese, the following Tuesday, May 21, at 3:27pm, an “unauthorized user” logged into Makani’s Microsoft email account via a virtual private network (VPN) located in Moscow, Russia. Corvese does not otherwise say how the hacker got access to the account.
At 5:06pm the same day, Makani’s email was again accessed, this time via a VPN in Kansas City, Missouri. At that time, the hacker read the “Sandpiper Venture Fund LP – Capital Call – (Due May 31, 2024)” email that had been cc’ed to Makani.
The next day, May 22, at 2:58pm, the hacker drafted a reply to Carr’s email, which Corvese notes allowed the hacker to copy information from the email. At 2:59pm, that draft was deleted.

At 3:01pm, the hacker sent an email to Makani from a fake email account, [email protected], replacing the lowercase I in Carr’s real email account with a lowercase L. the email was copied to three other Invest Nova Scotia employees, Lidija Marusic, Charlene Martell-Isnor, and Christine Chisholm, as well to a “Cathy Bennett” using the false @sandplper.vc (with the lowercase L) domain. The email gave false banking information for Sandpiper. Makani’s spam filter blocked that email.
At 3:02pm, the hacker changed the spam filter rules on Makani’s email account to allow receipt of emails from the @sandplper.vc domain.

At 4:04pm, the hacker sent a followup email, using the account [email protected], again replacing the lowercase I with a lowercase L, and purporting to come from Cathy Bennett, the Sandpiper managing partner. The followup email was sent to Makani, and copied to three other Invest Nova Scotia employees, Lidija Marusic, Charlene Martell-Isnor, and Christine Chisholm.
In her affidavit, Stephanie Corvese, the digital forensics investigator, does not say what if any responses came from Invest Nova Scotia employees, as her affidavit only addresses the hack itself.
But we know from Hill’s court statement that the next day, May 23, Invest Nova Scotia transferred some significant amount of money to the bank account falsely purporting to belong to Sandpiper.
But the misdirection wasn’t discovered until June 6, fully two weeks after the money had been transferred to the hacker’s bank account.
Invest Nova Scotia responds
Peter MacAskill, the CEO of Invest Nova Scotia, spoke with the Halifax Examiner this morning. He did not downplay the seriousness of the hack and stolen funds, and he answered all questions as fully as he could.
MacAskill said “approximately $573,000” had been transferred. He said Invest Nova Scotia learned of the scam only after Sandpiper inquired about the money it had requested but not received. Once the improper transfer was discovered, Invest Nova Scotia alerted the Department of Economic Development and the Halifax Regional Police. In turn, Economic Development brought in the Department of Digital Security and the Information and Privacy agency. The protocol for such hacks is now something of a routine.
Asked if the timing of the hack — coming so soon after the Sandpiper capital call — reflected some inside knowledge on the hacker’s part, MacAskill said that was an initial worry, but now investigators don’t think that’s the case.
Makani appears to have fallen victim to a classic phishing operation, in which he clicked on a link in an email that he thought was safe but that enabled the hacker to gain access to his system, said MacAskill. However it happened, the hacker obtained all the information needed to navigate through the multi-factor authentication that Invest Nova Scotia uses for its email.
MacAskill said that in the aftermath of the hack, Invest Nova Scotia’s systems have been overhauled, passwords changed, the multi-factor authentications strengthened, and other security improvements made.
A “majority” of the misdirected funds are still held by RBC, said MacAskill, although he couldn’t say exactly what that meant.
Sandpiper has since received the $573,000 it requested.
(Send this item: right click and copy this link)
2. Breaking: PostMedia to acquire SaltWire
As we go to press, we’ve received word that PostMedia has agreed to acquire SaltWire. Details here. I note that the release uses the word “acquire” and not “buy.” More on this later.
3. Tiny homes in Sackville

“Community Services Minister Brendan Maguire says his department is on track to start moving people into the tiny home community under construction in Lower Sackville this fall,” reports Yvette d’Entremont:
The first phase of the tiny home community will include 20 people, with the remaining residents expected to move in this winter. The community is being built on the former Cobequid Road ballfield tent encampment site.
While initially slated to accommodate 52 tiny homes, on Thursday the Department of Community Services said it will now include 60 supportive housing units that will accommodate up to 70 people.
Click or tap here to read “Lower Sackville tiny home community will welcome first residents this fall.”
(Send this item: right click and copy this link)
4. Houston ‘optimistic’ about direction of Nova Scotia Guard

This item is written by Yvette d’Entremont.
Since the province opened its online registration portal for the Nova Scotia Guard last month, more than 1,000 people have signed up.
The premier’s office introduced the Nova Scotia Guard volunteer corps initiative in a March 28 media release. It’s described as a group of volunteers from across the province with specialty skills and members of the public who will help communities during and after emergencies.
The new registration portal notes that the province “is experiencing more and more emergency situations, like wildfires, floods, and blizzards.” It also says Nova Scotia Guard volunteers “will help us be better prepared to respond when an emergency occurs.”
As reported here in May, a former fire chief expressed cautious optimism along with concerns about the Nova Scotia Guard. Last month, Halifax Search and Rescue’s (HSAR) chief director told the Halifax Examiner his organization wanted to join the provincial association at the table for future talks.
“I do believe that in the fullness of time, when we look back, we’ll think well, at some point there wasn’t a guard. It’ll be that it’ll be that ingrained,” Premier Tim Houston said while answering questions from reporters on Thursday.
Of the more than 1,000 people who’ve signed on so far, Houston said they possess a wide range of skill sets. He said about 400 of them have first aid training.
“People were offering up pastures for large animals. That’s an issue that happens,” Houston said. “Everything from chainsaw abilities to just helping out in a comfort centre.”
Houston said the province is meeting with fire departments, ground search and rescue, local non-profit organizations, and other community groups.
“Just talking to them and encouraging them to be part,” he said. “But I would say for where we’re at in the process, I’m pretty optimistic about where it’s all going.”
(Send this item: right click and copy this link)
5. Hunting review

“Nova Scotia’s natural resources minister says the province is going to conduct a full review of hunting regulations and laws in the province,” reports Yvette d’Entremont:
Tory Rushton made the comments Thursday while answering reporters’ questions about the three year suspension of the Cape Breton moose hunt.
Click or tap here to read “Nova Scotia Department of Natural Resources to conduct review of province’s hunting regulations and laws.”
(Send this item: right click and copy this link)
Government
No meetings
On campus
No events
In the harbour
Halifax
05:45: Amethyst Ace, car carrier, arrives at Autoport from Emden, Germany
06:00: MSC Sines R, arrives at Pier 42 from Montreal
07:15: Nolhan Ava, ro-ro cargo, arrives at Pier 41 from Saint-Pierre
11:00: CB Pacific, oil tanker, sails from Irving Oil for sea
11:30: MSC Sines R sails for sea
11:45: Amethyst Ace sails for sea
16:00: Don Quijote, car carrier, arrives at Pier 9 from Southampton, England
16:30: CSL Tacoma, bulker, arrives at Gold Bond from Philadelphia
17:30: Nolhan Ava sails for Saint-Pierre
18:00: Oceanex Sanderling, ro-ro container, sails from Fairview Cove for St. John’s
21:00: Don Quijote moves to Autoport
21:30: Stavanger Pride, oil tanker, arrives at Imperial Oil from Antwerp, Belgium
22:00: Augusta Unity, cargo ship, sails from Pier 27 for Bilboa, Spain
Cape Breton
05:00: Baie St.Paul, bulker, moves from Port Hastings to Aulds Cove quarry
15:00: Radcliffe R. Latimer, bulker, arrives at Port Hawkesbury anchorage from Port-Daniel, Quebec
Footnotes
Iris said she wants a video. Here’s a video: