CCQ cyberattack: only 10% have activated their protection, a guide for your employees
Nearly 685,000 people have received, or will receive by the end of October, a letter or email from the Commission de la construction du Québec (CCQ) offering two years of free credit monitoring through Equifax. On October 16, the CCQ reported a worrying figure: only 10% of the people concerned have activated that protection.
If you run a construction SMB, a good part of your crew is probably in the other 90%. Here’s what we know about the CCQ cyberattack, the typical scam call to recognize, a sheet to post in the site trailer and the five things to do as an employer.
CCQ cyberattack: where things stand
The attack was detected on the morning of August 24. The CCQ’s online and phone services stayed down until September 8. According to the CCQ, it was able to restart thanks to reliable backups, without paying the attackers.
10%
of the nearly 685,000 people concerned had activated their Equifax protection as of October 16, 2026, according to the CCQ.
Why so many people? Since September 29, the CCQ has extended the mailing to workers who dealt with it in the past and whose social insurance number (SIN) may have been affected. Some haven’t worked in construction for years: the CCQ notes that information can be kept even without recent interaction.
What was affected, according to the CCQ
| What the CCQ says (Oct. 16) | |
|---|---|
| What was stolen | Client and employee information, including the SIN of workers who dealt with the CCQ over the years. |
| Banking info, passports, licences | According to the CCQ, there is no indication for now that this customer information is affected. |
| What it means for you | Activate the protection if you received it, watch your accounts and be wary of calls. |
The call to recognize (fictional example)
A high-profile breach, with official letters arriving by the hundreds of thousands, is the perfect backdrop for a scammer. Here’s what the call could sound like, and the four signals that should make you hang up.
The four red flags
- 1The made-up urgency. According to the CCQ, protection lasts 24 months from the day you sign up.
- 2The SIN over the phone. The CCQ warns it won’t confirm by phone which information was compromised: everything goes through the written notice.
- 3You type the activation code yourself at equifax.ca/fr/activer/, entering the address in your browser. Nobody needs to read it for you.
- 4The texted link to your banking details: hang up, then call back the official number printed on your letter.
The sheet to post in the site trailer
CCQ cyberattack
Your free protection: 5 steps, 15 minutes
- Check your mail and email, spam folder included: the CCQ reaches out by letter or email.
- Activate the protection at equifax.ca/fr/activer/ by typing the address yourself. Equifax help line: 1 866 349-5204.
- Nothing received by the end of October even though you worked in construction? Call the CCQ at 1 888 842-8282.
- Never give your SIN or your code to someone who calls you: hang up and call back the official number.
- Watch your bank statements. You can also ask for a security alert on your SIN or lock your file with Equifax or TransUnion.
Sources: CCQ update of October 16, 2026, and CCQ FAQ. Sheet prepared by NeoTech Cloud Solutions, free to copy for your crew.
The employer’s five steps
To do this week
- ☐ Post the sheet above in the site trailer and share it in the crew’s messaging group, in French and in your employees’ languages.
- ☐ Set aside 15 minutes at the end of a break so everyone activates their protection on their own phone: you never touch their codes.
- ☐ Warn the office: any request to change an employee’s direct deposit or banking details gets confirmed by voice, at the number you already have.
- ☐ Tell your accountant and whoever runs payroll: a fake “CCQ” email asking for employee lists or SINs is a red flag.
- ☐ Clean house: which SINs, void cheques and ID documents of former employees do you still keep, and why?
The lesson for every SMB
Two things mattered in this story. First, backups: the CCQ could restart its services without negotiating with the attackers. Second, retention: the longer an organization keeps data, the more people a breach hits. Quebec’s Law 25 requires you to destroy or anonymize personal information once its purpose has been fulfilled, subject to legal retention periods. The SIN of an employee who left eight years ago, sitting in a shared folder, is a risk with no benefit at all.
To go further: the T4 slip breach and the before/after for your SMB, our scorecard to rate your vendors after a breach, the Danish 123456 password breach, and our backup and disaster recovery offer, with proactive monitoring of your systems.
Book your free cyber check
Do you also keep employees’ SINs, void cheques or ID documents? The free cyber check finds where that data sits, who can access it and whether your backups would let you restart without paying a ransom, and gives you a clear list of fixes.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- CCQ, “Incident de sécurité informatique – Mise à jour sur la situation” (in French), October 16, 2026
- CCQ, “Incident de sécurité informatique 24 août 2026” page and FAQ (in French), updated October 16, 2026
- APCHQ, “Incident de cybersécurité à la CCQ : vérifiez vos communications reçues” (in French), October 5, 2026
Photo: ANTONI SHKRABA production, Pexels (Pexels licence).