An IT service can restart while the consequences of data theft continue. The cyberattack on the Commission de la construction du Québec (CCQ) illustrates this: after the incident was detected on 24 August 2026 and services were restored on 8 September, protecting people remains a matter in its own right.
For the workers and former workers concerned, the practical issue is no longer simply being able to log in. They need to understand the communication they have received, check the status of their file and, where applicable, activate the protection on offer. These steps do not all take place as soon as the servers are back up and running.
Nearly 685 000 people: what this figure measures
In its communication of 16 October, the CCQ explains that it adopted a cautious scope: nearly 685 000 people who may have been affected by the incident. It is offering them two years of credit monitoring and identity protection through Equifax, free of charge.
This total refers to the people the organisation intends to offer protection to. It does not show that every one of them had the same information stolen, nor that as many cases of fraud took place. This distinction changes how the incident should be understood: a broad precautionary measure is not an individual assessment of the damage.
The offer was extended from 29 September, notably to former workers whose social insurance number may have been affected. The notification received by each person therefore remains important for understanding their own situation; the overall figure does not replace it.
Protection on offer is not protection activated
The CCQ was still urging recipients to take action in its update of 16 October. It said at the time that only 10 % of the people who may have been affected had activated the service. This percentage relates to that dated communication: it does not necessarily describe the current situation.
This gap reveals a very practical challenge in the aftermath of an incident. Sending a letter, getting it to the right address, having it read and then completing the registration are four different steps. For someone who has not had recent dealings with the organisation, the message may also seem unexpected. Treating it as a routine administrative notice risks missing a useful step.
The APCHQ had called on people to check communications from the CCQ as early as 5 October. The association urged contractors to look in particular for the activation code and to consult the official frequently asked questions. Its intervention serves as a point of contact for the sector; it does not constitute an independent assessment of the extent of the theft.
What the service does—and does not—promise
The CCQ’s frequently asked questions describe alerts about credit files, monitoring of data on the dark web and support in the event of fraud or identity theft. These functions are intended to detect certain signs and make it easier to respond.
They should be understood for what they are: monitoring and support measures. Opening a protection account does not retrieve information that has already been copied and does not allow anyone to claim that no malicious use will occur. Conversely, receiving an alert or a protection notification does not automatically mean that financial fraud has already been established.
The right approach is therefore to distinguish between information about the incident, registration for the service on offer and any events subsequently detected. Confusing these three levels may lead either to playing down the problem or to panicking on receipt of a precautionary letter.
Older files make notification more difficult
The CCQ notes that some of the contact details it holds may have become inaccurate, particularly following a move or an unreported death. A letter may therefore not reach the intended person straight away. Not receiving a letter in the post does not, in itself, confirm that the file is outside the scope of the incident.
People who think they may be affected but have not received the information are directed to the organisation’s customer service department. Details of the information compromised should be sought in the written communications issued for that purpose. It is preferable to find the contact details on the official website rather than provide sensitive information to someone whose identity has not been verified.
Two timelines to follow
This incident is a reminder that the technical timeline and the timeline for individuals do not overlap. The resumption date answers the question of service availability. Tracking notifications and protection answers the question of the consequences for users. Both matter when assessing whether the crisis has passed.
The Quebec case therefore goes beyond the initial outage: it shows why the quality of a response to a data breach is also measured by whether each person can understand what is happening to them and actually use the help on offer.
Illustrative photograph: a hard hat; it is not equipment photographed at the CCQ’s premises.
