BREAKING: Personal Information Stolen in CCQ Cyberattack — Free Equifax Protection Offered to Those Affected
By Jason LaFace | Alberta Radio
September 7, 2026
AUGUST 24 CYBERATTACK | PERSONAL INFORMATION COMPROMISED
The Commission de la construction du Québec (CCQ) says personal information belonging to some of its clients and employees was stolen during a cyberattack detected on August 24, 2026.
The organization has now announced measures intended to help protect people whose information was compromised, including access to Equifax identity and credit protection services at no cost to those affected.
The incident is another reminder of the enormous amount of personal information held within government agencies, corporations and other large organizations — and the potential consequences when criminals manage to gain access to those systems.
What Happened?
According to information released by the CCQ, the organization was targeted in a cyberattack on August 24.
The CCQ subsequently determined that the attackers had obtained some personal information belonging to clients and employees.
Individuals identified as having been affected are being contacted directly by the organization.
The incident has also been reported to the appropriate authorities, while the investigation into the attack and its consequences continues.
Free Equifax Protection for Affected Individuals
One of the most important developments for those caught up in the breach is the offer of identity and credit protection through Equifax.
According to the CCQ's announcement, affected individuals are being offered the service free of charge.
The protection includes services intended to help people identify suspicious activity involving their personal information, including:
* Credit-file monitoring and alerts;
* Monitoring for personal information appearing on the dark web;
* Alerts concerning potentially unusual activity;
* Assistance in the event of fraud or identity theft; and
* Identity-theft insurance coverage of up to $1 million.
People determined to have been affected should receive instructions directly from the CCQ explaining how to activate the protection.
Why Stolen Personal Information Matters
A cyberattack doesn't necessarily end when an organization's computer systems are restored.
If personal information has been copied or stolen, criminals can potentially attempt to exploit that information long after the original breach.
Depending on exactly what information was compromised, stolen data can potentially be used in phishing campaigns, attempts to access accounts, impersonation schemes and identity fraud.
Information obtained from one breach can also sometimes be combined with information obtained elsewhere to make fraudulent communications appear considerably more convincing.
That makes vigilance particularly important following any confirmed compromise of personal information.
Be Alert for Follow-Up Scams
There is another danger people should keep in mind.
Major data breaches can themselves become opportunities for scammers.
Someone who knows about the CCQ incident could send an email or text claiming to represent the CCQ, Equifax or another organization and tell the recipient they need to immediately "verify" their account.
That urgency can be used to convince someone to click a malicious link or surrender additional personal information.
Anyone receiving communications concerning the breach should verify that the message and instructions are legitimate before providing sensitive information or following links.
When in doubt, go directly to the organization's official website or contact it through a verified telephone number rather than relying on contact information contained in an unexpected message.
Another Reminder About Canada's Cybersecurity Challenge
Canadians increasingly conduct their lives through interconnected digital systems.
Employment information, banking details, government records, tax information, health information and countless other pieces of personal data are stored electronically.
That convenience also creates an enormous cybersecurity responsibility for organizations entrusted with that information.
Cybersecurity can no longer be treated simply as an IT department issue.
For organizations holding sensitive personal information, it is an issue of privacy, public trust, operational security and accountability.
When breaches occur, Canadians deserve clear answers about what happened, what information was compromised, what measures are being taken to protect affected people and what will change to reduce the likelihood of another incident.
What Should You Do If You're Contacted?
If the CCQ contacts you and confirms that your information was affected, carefully review the information it provides and consider activating the identity and credit monitoring being offered.
Continue watching your financial accounts and credit information for activity you don't recognize.
Be especially suspicious of unexpected messages asking for passwords, banking information, identification numbers or other sensitive information.
And remember: the existence of a real cyberattack doesn't automatically make an email, text message or phone call about that attack legitimate.
Cybercriminals depend on confusion and urgency.
Taking a few extra minutes to verify who you're communicating with can make an enormous difference.
---
ALBERTA RADIO
Real People. Real Conversations. A Stronger Alberta.
For more news, commentary and independent coverage, visit www.albertaradio.ca
