Cybersecurity incident involving some MÉDIC Construction insureds

On October 13, 2023, the Commission de la construction du Québec (CCQ) was informed by one of its suppliers that confidential data concerning most MÉDIC Construction insureds were involved in a cybersecurity incident.

It was only on October 24, following an analysis conducted by the CCQ, that it was confirmed that specific personal information was potentially affected by the security breach.

So far, we have no indication that the affected data have been disclosed or used for malicious purposes. The Commission’s computer systems are not affected by this incident. Operations are continuing and the online services are working normally.

All MÉDIC Construction insureds received a letter between November 7 and November 15, 2023, specifying actions to take related to their situation.

This letter contained all the information about Equifax’s offer of protective services for affected insureds and their dependents. For more information, consult the Frequently Asked Questions below.

The protection and security of the personal information held by the CCQ are an absolute priority, and we are extremely sorry about any anxiety that this situation may be causing you.

What happened?

On October 13, the Commission de la construction du Québec (CCQ) was informed by one of its suppliers that confidential data concerning most of MÉDIC Construction’s insureds had been affected by a cybersecurity incident.

To manage and administer MÉDIC Construction insurance claims, the CCQ works with the supplier GreenShield Canada (GSC), which uses the specialized platform MOVEit for secure data transfers. The cybersecurity breach in question here took place last May, as part of a well-documented incident involving MOVEit, affecting at least 66 million individuals all over the world.

It was only on October 24, following an analysis conducted by the CCQ, that it became clear that the personal information of MÉDIC Construction insureds, as well as the identities of those concerned, had been affected by the security breach.
How many people are affected by the cybersecurity incident?

Most of MÉDIC Construction’s insureds and their dependents have been affected by the incident. Worldwide, the security breach involves 66 million individuals.
How do I know if my dependents or I are among the people affected?

MÉDIC Construction’s insureds affected by the cybersecurity incident have already received a letter from the Commission de la construction du Québec. The letters were sent on Novembre 6, 2023.

Insureds who were not affected also received a letter confirming that they do not have to take any measures.
I've received two letters from you concerning the cybersecurity incident. What should I do now?

If you received two letters, concerning the cybersecurity incident, please consider the one informing you that you have been affected to be the correct one.
What do I do if my data were affected by the incident?
As a MÉDIC Construction insured, you must notify your dependents, if applicable, of the situation and of the measures they can take to protect themselves.

For more information or for any further questions, contact the Customer Service at 1 888 842-8282, Monday to Friday, 8:30 a.m. to 4:30 p.m.

At the time of the incident, we strongly recommended that you use Equifax’s credit-surveillance and identity-theft-protection services. Following this incident, a free 24-month subscription was offered to affected MÉDIC Construction insureds and to their dependents age 18 and over. Information on how to subscribe to these services was included in the letter that has been sent to you. You had until February 29, 2024 to activate your account.
What data in my file may have been affected by the incident?
This cybersecurity incident affects only the following personal information about you and your dependents:

Last name, first name, gender

Residential and electronic addresses (excluding dependents)

Telephone number (excluding dependents)

Date of birth

Bank account number (excluding dependents)

Some brief details related to claims

All other information held by the CCQ, notably your social insurance number, were not affected.
There was a delay between the announcement of the massive MOVEit leak and confirmation that MÉDIC Construction insured’s data were affected. How do you explain this?

Although the event behind the cybersecurity breach took place in May, it is important to note that the CCQ was informed on October 13 by one of its suppliers that the confidential data of MÉDIC Construction insureds and their dependents were concerned. However, it was only on October 24, following an analysis conducted by the CCQ, that it was confirmed that specific personal information, and the identities of the people concerned, were potentially affected by the security breach.
Does this situation have an impact on my benefits or MÉDIC Construction services?

No. This situation has no impact on your benefits (vacation cheque, pension, etc.) or the services offered by MÉDIC Construction.
What measures have been taken to ensure that this situation doesn’t occur again?
The CCQ takes the protection of its clients’ personal information very seriously. Therefore, we are taking concrete measures, including the following:

Taking responsibility and following up closely with the supplier to ensure that strict measures are applied

Keeping a watch on all digital platforms, including hacker sites, to identify any malicious use of data

A review by an external consultant to recommend all new practices to implement, notably with our suppliers, to avoid having such a situation occur again

The obligatory declarations to the Commission d’accès à l’information du Québec and the Registre d’incident
I’m uneasy about the security of my and my dependents’ data. What measures can I take as a precaution?

You can take several measures to protect your personal information.

Keep an eye on your accounts: Regularly check your bank accounts and other online accounts to uncover any suspicious activity. Notify your financial institution of any unauthorized activity or concern.

Change your passwords: As a precaution, regularly change the passwords on all your online accounts. Choose passwords that are difficult to guess and avoid reusing them on different platforms.

Be vigilant: Be particularly careful when you receive emails (especially those with a suspicious link or attachment) or unsolicited messages or phone calls asking you to provide personal information.
I still have questions. Where can I get answers?

For any question or concern about this incident, please call the Customer Service at 1 888 842-8282, Monday to Friday, 8:30 a.m. to 4:30 p.m.
What is MÉDIC Construction?

MÉDIC Construction is a private insurance plan reserved exclusively for members of the construction industry and completely financed by them. To find out more.
What is a dependent?
Dependents of an insured (employee or retiree) person may benefit from insurance coverage when they are recognized by MÉDIC Construction. To do this, the insured must declare his or her dependents and provide the required documentation.

An employee’s or a retiree’s dependents may be:

A spouse

Dependent children

A spouse’s children who are an employee’s dependents

To find out more about dependents, click here.
What should I do if I think I have been the victim of fraud?
Up to now, we have no indication that the data affected have been disclosed or used to malicious intent. However, if you think you have been a victim of fraud :

Report the incident to local police as quickly as possible

Advise your bank and credit card companies if it is a financial incident

Contact Equifax so they can take the necessary action for your situation

Notify the Canadian Anti-Fraud Centre

Report any missing identity documents or cards, such as a driver’s licence, a health card or immigration documents to the appropriate organization

Change your passwords and monitor your accounts regularly
I would like to make a complaint to the CCQ; how can I do this?

You can make a complaint online by filling out the electronic form.