A class-action lawsuit application has been filed in Quebec Superior Court against the Commission de la construction du Québec (CCQ) after a cyberattack compromised the personal information of approximately 350,000 employees and clients. The lawsuit seeks compensatory and punitive damages, to be determined, for individuals whose personal information was compromised in the cyberattack that resulted in unauthorized access to the CCQ’s computer systems on Aug. 24. According to the law firm handling the class-action lawsuit, Lambert Avocats in Montreal, information that may have been accessed includes names, addresses, dates of birth, CCQ client numbers, and social insurance numbers. The CCQ regulates and administers the construction industry in Quebec. “In accordance with the Act respecting Access to documents held by public bodies and the Protection of personal information, our client was entitled to expect that his personal information would be protected by the CCQ, but also that the CCQ would take reasonable measures to reduce the risk of harm resulting from the incident,” the law firm said. “By failing to put in place adequate security measures to protect a database containing social insurance numbers, when it had already been the target of a cyberattack in 2023, the CCQ seriously neglected the protection of its customers’ personal information.” The law firm said the CCQ suspended its systems for more than two weeks after the cyberattack, interrupting its online and telephone services. On Sept. 11, an individual involved in the lawsuit told the law firm they received an email from the CCQ that their personal information may have been compromised. The law firm said the CCQ recognized that other information in its possession may also have been accessed in the cyberattack. “Since the incident, our client has been living in worry and has been checking his bank accounts daily to ensure that he is not a victim of fraud,” the law firm said. The CCQ offered its employees and clients a free two-year subscription to a credit monitoring service, with a registration deadline of Nov. 30. In a statement to CTV News, the CCQ said it launched an investigation following the cyberattack. “It has made it possible to confirm that the incident was not linked to the Chantier numériccq, to identify the vulnerability exploited, and to correct it,” the statement reads. “This work also made it possible to securely restore our services and systems on September 8. Because we had reliable backups, we were able to re-establish our services quickly and securely: the decision was therefore made not to negotiate with the cybercriminals.” It said it is taking the necessary measures to protect individuals from the cyberattack. “We have moved proactively from the beginning of the incident to protect all these people, because we know that personal information has been stolen,” the statement said. “We have already begun to contact the individuals concerned directly so that they can obtain the protection offered by Equifax, and any further individuals added will be contacted in coming weeks.” The CCQ said it will also mandate an independent expert to conduct an external audit of its practices and aims to implement the recommendations. However, the law firm called these measures inadequate. “The risk of identity theft resulting from the theft of a social insurance number does not disappear after twenty-four months, and the monitoring offered covers only one of the two credit bureaus, so a fraudulent credit application processed by one institution doing business with the other agency would escape detection entirely,” the law firm said. Individuals affected by the cyberattack are automatically enrolled in the class-action lawsuit.
