On September 12, 2026, our office filed a class action against the Commission de la construction du Québec. This claim seeks compensatory and punitive damages for individuals whose personal information was compromised in the August 24, 2026 cyberattack.
Our client’s
story On August 24, 2026, the Commission de la construction du Québec was the victim of a cyberattack that resulted in unauthorized access to its computer systems. The CCQ then shut down its systems, interrupting its online and telephone services for more than two weeks.
According to information made public, the personal information of approximately 350,000 people was stolen. The CCQ confirmed on September 11, 2026, that information from its customers and employees had indeed been stolen.
On September 11, 2026, more than three weeks after the incident, our client received an email entitled “Notice – Computer Security Incident at the Commission de la construction du Québec” informing him that his personal information may have been compromised.
This information includes full name, address, date of birth, CCQ client number and social insurance number. The CCQ also recognizes that it is possible that other information in its possession may also have been affected.
Since the incident, our client has been living in worry and has been checking his bank accounts daily to ensure that he is not a victim of fraud.
It also noted that the only measure offered by the CCQ is a free two-year subscription to a credit monitoring service, offered by only one of the two credit reporting agencies active in Québec and with a registration deadline of November 30, 2026.
The proposed
class action In accordance with the Act respecting Access to documents held by public bodies and the Protection of personal information (hereinafter the ” Access Act “), our client was entitled to expect that his personal information would be protected by the CCQ, but also that the CCQ would take reasonable measures to reduce the risk of harm resulting from the incident.
By failing to put in place adequate security measures to protect a database containing social insurance numbers, when it had already been the target of a cyberattack in 2023, the CCQ seriously neglected the protection of its customers’ personal information.
In addition, the mitigation measures offered to those affected are clearly inadequate. The risk of identity theft resulting from the theft of a social insurance number does not disappear after twenty-four months, and the monitoring offered covers only one of the two credit bureaus, so a fraudulent credit application processed by one institution doing business with the other agency would escape detection entirely.
The targeted
group All individuals whose personal information was compromised during the cyberattack on the Commission de la construction du Québec on August 24, 2026.
Applications lodged with the Court
Application for authorization to bring a class action
Current status of the file
Pending authorization by a judge of the Superior Court.
How to be part of the class
action If you meet the definition of the group covered by this class action, you are automatically part of the class action. However, we encourage you to register on our form to stay informed.
Contact
Form
We want to hear from you. To properly represent the members of this class action, we would like to document your experience.
Notice: Submitting your information via the registration form above does not create a lawyer-client relationship and does not commit you to paying legal fees.