A school in the Eastern Townships has confirmed it was hit by a cyberattack that resulted in the compromise of personal information. Technical details remain limited, but the incident illustrates a reality that every Quebec organization holding personal information should take seriously.
Key points
- A cyberattack against Collège du Mont Notre-Dame, in Quebec’s Eastern Townships, compromised personal information, according to information currently available.
- The type of attack and the exact categories of information affected have not been disclosed to date.
- Schools hold sensitive data on students and staff, making them attractive targets.
- Law 25 requires organizations to maintain an incident register and, in some cases, to notify the Commission d’accès à l’information (Quebec’s privacy regulator).
What do we know about this incident?
Based on information currently available, Collège du Mont Notre-Dame was hit by a cyberattack that compromised personal information. The type of attack, its full scope, and the categories of information involved have not been disclosed publicly, which calls for caution in interpreting an event that remains only partially documented.
Public information remains limited at this stage. It is not unusual for an organization affected by a security incident to take time before clarifying the real extent of a breach, while internal or external investigations proceed. We are therefore avoiding any speculation about the number of people affected, the attack vector, or the measures taken by the institution, since the available source does not specify any of these details.
Why are schools attractive targets?
Schools and colleges hold rich records, including personal information on students and employees, financial data, and academic files, often with limited IT resources to protect them. This combination of valuable data and sometimes limited defenses makes them recurring targets for attackers.
The education sector is regularly identified in threat analyses as an exposed sector, alongside healthcare and public bodies. What draws attackers is less an institution’s profile than the depth of personal information it holds over long periods, often covering several thousand people. A nonprofit or SMB that manages student, member, or client records faces a comparable risk profile.
What does this mean for a Quebec SMB or nonprofit?
This incident is a reminder that an organization’s size offers no protection: what matters to an attacker is the value of the data held, not the victim’s profile. Any organization that retains personal information should regularly review its protection practices and legal obligations.
In Quebec, the Act respecting the protection of personal information in the private sector governs the handling of confidentiality incidents for organizations of every size. It requires organizations to maintain an incident register and, where there is a risk of serious harm, to notify the Commission d’accès à l’information as well as the individuals concerned. No organization is immune from cyberattacks; no credible provider can guarantee zero risk. A realistic goal is to substantially reduce exposure and to prepare a structured response for when an incident occurs despite these efforts.
How can an organization reduce its exposure?
There is no universal formula, but certain baseline practices, such as an inventory of the data held, access controls, tested backups, and staff awareness training, make an incident considerably harder to exploit and faster to contain when one occurs despite these efforts.
The Canadian Centre for Cyber Security publishes baseline controls designed specifically for small and medium organizations, which typically lack a dedicated security team. Treating any claim of complete protection with skepticism remains a sound instinct: cybersecurity is about continuously reducing risk, not eliminating it once and for all.
FAQ
Has Collège du Mont Notre-Dame disclosed the number of people affected?
No. Based on information available at the time of writing, neither the exact number of people affected nor the precise categories of information compromised have been made public. This kind of initial uncertainty is not unusual after a security incident is discovered; affected organizations typically conduct a technical and sometimes legal investigation before clarifying the real scope of the data involved. We therefore urge caution regarding any coverage of this story that cites specific figures, a particular type of attack, or attribution to a specific group, since the available press source does not provide any of these details.
Is an SMB or nonprofit required to report a personal information breach?
In Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, requires every organization to maintain a register of confidentiality incidents. When an incident presents a risk of serious harm to the individuals concerned, notifying the Commission d’accès à l’information and the affected individuals becomes mandatory. This obligation applies regardless of an organization’s size or sector: a school, an accounting firm, a community organization, or a manufacturing SMB are all subject to it as soon as they hold personal information.
Is there a solution that completely eliminates the risk of a cyberattack?
No, and any vendor who claims otherwise should be treated with skepticism. No provider, however skilled, can guarantee zero risk against constantly evolving threats. What is realistic, however, is substantially reducing an organization’s exposure through recognized measures, such as access management, reliable backups, regular updates, and staff training, and building a response capability to limit the consequences if an incident occurs despite these efforts. Cybersecurity is measured by continuous risk reduction, never by the permanent elimination of threats.
Sources
- 107.7 Estrie, via Google Actualités · press, 2026
- Commission d’accès à l’information du Québec · obligations, incident register and notification
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · baseline checklist
