A cyberattack on the Commission de la construction du Québec (CCQ) has led to the personal information of roughly 350,000 individuals being posted on the dark web by a group of Russian‑speaking hackers. The breach, reported on Monday, September 14, 2026, involved the theft of data from the regulator’s website and the subsequent public release of that data on illicit online platforms.
The compromised information includes driver’s licenses, passports, bank account details and credit‑card statements. Those records were extracted from the CCQ’s online systems, which serve as the official portal for Quebec’s construction industry regulator. The scale of the leak means that a large segment of the province’s construction workforce and related personnel may now be vulnerable to fraud and identity theft.
Authorities have confirmed that the stolen files are being circulated on the dark web, where they can be accessed by other malicious actors. While the exact method of entry into the CCQ’s network has not been disclosed, investigators are focusing on the involvement of the Russian‑speaking cyberpirates who claimed responsibility for posting the data.
The CCQ has advised affected individuals to monitor their financial accounts and to consider protective measures such as credit monitoring. Quebec’s privacy regulator is also reviewing the incident to determine compliance with provincial data‑protection laws. The incident adds to a growing list of high‑profile cyber‑thefts targeting Canadian institutions in recent months.