October 19, 2026 Insights 8 min read

CCQ Cyberattack: Why Only 10% Have Activated Their Free Protection

By Cybersecurity Canada Editorial Team | Published October 19, 2026

The CCQ cyberattack discovered on Monday, August 24, 2026, may affect nearly 685,000 people, but as of October 16, 2026, only 10% of those who may be concerned have activated the free credit monitoring and identity theft protection that the Commission de la construction du Québec (CCQ) is offering. That statistic, reported in CCQ's own October 16 update, highlights a gap that Canadian employers should understand: a breach notification only protects people if they act on it.

For Canadian businesses whose workers, subcontractors, or customers may receive breach letters from CCQ or any other organization, here is what you need to know to help them verify the notification is real and actually activate the protection offered.

What Happened in the CCQ Cyberattack?

The CCQ discovered a computer security incident on Monday, August 24, 2026. According to the official incident page, the investigation confirmed that the incident was a cyberattack, and that some personal information of clients and employees was stolen. The CCQ restored its online and telephone services on Tuesday, September 8, 2026.

La Presse reported on September 4, 2026 that the Russian-speaking ransomware group Qilin had claimed responsibility for the attack, as reported by the monitoring service Ransomware.live. CCQ CEO Audrey Murray confirmed the information to La Presse and said a complaint had been filed with police. CCQ's own updates do not name the group. Murray also said the sensitive personal information potentially affected may include dates of birth and social insurance numbers, adding that "not all victims are at the same level" (our translation from French).

On September 29, 2026, CCQ announced that it was extending protection to additional individuals, mainly workers who had done business with CCQ in the past and whose social insurance number may have been affected. CCQ acknowledged that some contact information may no longer be current due to address changes or deaths not declared to CCQ.

By October 16, 2026, CCQ stated it would inform all individuals who might be concerned by the end of October: nearly 685,000 people. The protection offered through Equifax includes credit monitoring, dark web monitoring, alerts for unusual activity, specialized assistance for fraud or identity theft, and identity theft insurance of up to $1 million for a two-year period.

Why Have Only 10% Activated the Protection?

CCQ's October 16 update did not give reasons. Part of the gap may be timing: the 10% figure covers everyone who may be concerned, and CCQ said its final communications were still scheduled to go out "in the coming days." Beyond that, several other reasons are possible. Some recipients may not realize the letter is real. Some may intend to act but delay. Some may have moved and never received the notification. Some may find the activation process confusing. And some may distrust any letter that asks them to click a link or call a phone number.

That distrust is rational. The Canadian Anti-Fraud Centre warns that fraudsters send messages that appear to come from banks, businesses and government agencies, and that if you have been part of a breach, "fraudsters will use the information as a tool to steal your money." A breach notification letter creates exactly the conditions that phishing exploits: urgency, a request to take action, and a link to click.

How Can Someone Verify a Breach Letter Is Real?

Before clicking any link or calling any phone number in a breach notification, verify it independently:

1. Look up the organization's official website yourself. Do not click the link in the letter. Type the organization's domain directly into your browser. For the CCQ incident, the official site is ccq.org.

2. Find the official customer service number. CCQ lists 1 888 842-8282 for people who think they were affected but have not received a letter or email, and says it can verify their situation. For help activating the protection, CCQ lists the Equifax call centre at 1 866 349-5204.

3. Check the organization's own incident page. CCQ publishes its updates on ccq.org, including its October 16 update. If a letter describes something the official page does not mention, call the official number before acting.

4. Look for the red flags the Canadian Anti-Fraud Centre lists. These include email and website name spoofing, urgency, offers of refunds or money, seemingly "harmless" requests to click links, download attachments or fill out forms online, and instructions to scan a QR code. CCQ says its Equifax protection is free, so any message asking you to pay for it is not from CCQ. See our guide to recognizing phishing emails for more warning signs.

What Should Affected Individuals Do to Protect Their SIN?

If your social insurance number may have been exposed, Service Canada's guidance on SIN fraud and data breaches recommends the following steps:

Monitor your credit reports. Contact Canada's two major credit bureaus, Equifax Canada and TransUnion Canada, to request copies of your credit report (there may be a fee). Review them for accounts you did not open and credit inquiries you did not initiate. Consider adding a fraud alert to your file (there may be a fee), which instructs creditors to contact you before opening new accounts in your name.

Monitor your financial statements. Review your banking and credit card statements for any unauthorized activity.

Check your My Service Canada Account. Look for unfamiliar records of employment, which Service Canada lists as a sign that someone may be using your SIN.

Watch your mail. Look for opened envelopes or missing financial statements you were expecting.

If you determine that fraud has occurred, Service Canada advises filing a police report (with a case reference number), notifying the Canadian Anti-Fraud Centre at 1-888-495-8501, contacting the credit bureaus to add a fraud alert, and informing your creditors and financial institutions.

A new SIN is not the recommended response. Service Canada states that "having multiple SINs can increase fraud risk" and that "getting a new SIN does not erase your old SIN and does not protect it from future misuse."

What Lesson Should Canadian Employers Take from This Incident?

The CCQ breach highlights a pattern that any organization should consider: CCQ extended protection mainly to workers who had done business with it "over the years" and whose social insurance numbers may have been affected. CCQ has not said how long it keeps those records, and as the body responsible for labour relations, training and workforce management in Quebec's construction industry, it may have legal reasons to keep them. CCQ also acknowledged on September 29 that some contact information may no longer be current, meaning some affected individuals may never receive the notification.

This is a retention risk. The longer you keep sensitive data like SINs beyond legal or operational requirements, the more people you expose if that data is stolen. The Canadian Mennonite University cyberattack, which exposed T4 forms going back 10 years, illustrates the same pattern.

If your organization retains SINs for workers, contractors, or customers, ask whether you need to keep them as long as you do. Under the CRA's record retention guidance, you generally must keep required records and supporting documents for six years from the end of the last tax year they relate to, and some situations require longer, such as returns filed late or records you must keep indefinitely. Other federal, provincial or municipal laws can set their own retention periods. Once a record is past every retention period that applies to it, securely deleting it reduces your exposure in the event of a breach.

How Can You Help Your Workers Act on Breach Notifications?

If your employees or subcontractors work in Quebec's construction industry, some of them may be among the 685,000 people CCQ is contacting. Consider these steps:

1. Inform your staff that legitimate notifications are being sent. A brief internal message explaining that CCQ is contacting affected individuals, and that the letters are real, can reduce the chance that employees dismiss them as phishing.

2. Provide the official contact information. Share CCQ's customer service number (1 888 842-8282) and website (ccq.org) so employees can verify independently.

3. Remind them to act, not just read. The protection only works if activated. A brief reminder that the free monitoring must be turned on, and that it includes up to $1 million in identity theft insurance, may prompt action.

4. Direct them to government guidance. Service Canada's SIN protection page explains what to monitor and what to do if fraud occurs.

Could You Reach Your Former Workers After a Breach?

"If we had to notify hundreds of past workers about a data breach today, how many of them would we be able to reach, and how long would it take?"

The answer depends on how current your contact information is, how long you retain personal data, and whether you have a documented incident response plan. If you do not know the answer, our free cybersecurity assessment can help you identify gaps in your readiness across the 13 baseline control areas defined by the Canadian Centre for Cyber Security.

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). CCQ Cyberattack: Why Only 10% Have Activated Their Free Protection. Retrieved from https://cybersecuritycanada.ca/news/posts/ccq-cyberattack-breach-notification-protection-activation/

Permanent URL: https://cybersecuritycanada.ca/news/posts/ccq-cyberattack-breach-notification-protection-activation/ · Published October 19, 2026