Quebec construction commission to alert 685,000 people after cyberattack data theft

The Commission de la construction du Québec (CCQ) says it is contacting nearly 685,000 people, mostly construction workers, after confirming that personal information was stolen in a cyberattack that shut down its systems for two weeks in late summer.

The CCQ administers labour relations, training and benefit plans for Quebec's construction industry, so its records reach a large share of the province's trades workforce. The commission's expanded notice, updated Oct. 19, says protection is being offered mainly to workers whose social insurance number may have been affected.

What happened

According to the CCQ's incident page, the commission detected the first signs of a security incident early on Monday, Aug. 24. It shut down its systems as a precaution and opened an investigation with outside experts. Services stayed offline until Sept. 8.

The CCQ has since confirmed the incident was a cyberattack, unrelated to its ongoing digital transformation project, and that some information about its clients and employees was stolen. It says it has no indication that banking, passport or driver's licence information was affected, nor significant indication that dependants' sensitive data was involved. The incident does not affect pension rights or pension fund balances, it said.

Who claimed it

The Qilin ransomware group listed the CCQ on its leak site in early September, according to the tracking site ransomware.live. The CCQ has not publicly commented on the claim or said whether a ransom was demanded.

What the CCQ is offering

People being notified by letter or email receive 24 months of free Equifax Complet Supérieur protection, which includes credit and dark web monitoring, alerts and identity theft insurance of up to $1 million. The commission warns that some contact details on file may be outdated. It also says it will hire an independent expert to audit its security practices.

The CCQ had a separate incident in 2023 involving an outside provider's file transfer platform.

What we don't know yet

The commission has not said how the attackers got in, exactly which data fields were taken, or how many employees were affected.

What to do

• Construction workers who receive a letter should activate the Equifax service with the code provided; the support line is 1-866-349-5204.
• Anyone who has worked in Quebec construction and moved recently should check whether the CCQ has current contact details.
• Treat unexpected calls or messages about CCQ benefits, pensions or SINs as possible fraud.