CCQ Cyberattack: Protect Your Small Business

Your employees arrive on a Monday morning, but they can’t access the tools they need. Customer requests keep coming in. Files are unavailable. Your day has just taken a very different turn.

The cyberattack on the Commission de la construction du Québec (CCQ) is a reminder of how disruptive an IT incident can be. In its September 2, 2026 update, the CCQ confirmed that an incident detected on August 24 was linked to a cyberattack. The organization explained that it had shut down its systems as a protective measure and was working to gradually restore services.

The information made public does not establish which specific vulnerability led to the attack. It does, however, raise an important question for business owners: what can we do today to better protect our operations?

Reducing the risk of a cyberattack means securing access, keeping systems updated, training employees and monitoring unusual activity. Tested backups and an incident response plan help limit the damage if something does happen. These priorities align with guidance from the Canadian Centre for Cyber Security.

Here’s how to put them into practice in your business.

Secure access to your business systems

Your email, files and business applications deserve particular attention. Multifactor authentication, also known as MFA, adds another verification step when someone signs in, helping protect your accounts.

The method you choose matters, too. Options such as passkeys and compatible security keys provide phishing-resistant protection that not all authentication methods offer. Your IT team can help determine which options work with your tools.

It’s also important to review who can access what. Permissions should reflect each person’s current responsibilities. An employee departure, a role change or the end of a contractor’s assignment should trigger an access review. Administrative privileges should be limited to those who need them.

Ask your IT provider: “Which important accounts still lack multifactor authentication, and who reviews access when someone leaves?”

Make sure updates are actually being completed

A computer can work perfectly well while running vulnerable software. Security patches address known vulnerabilities, and keeping track of them means covering applications, equipment and operating systems.

Products that no longer receive security patches also need to be identified so you can plan replacements or assess the safeguards required.

For a business owner, the key question is who owns this responsibility. If several people handle updates without clear accountability, ask for an overall picture: what’s up to date, what isn’t and what needs attention first.

Ask your IT provider: “Can you show me which devices or applications need attention, who is responsible and when the work will be completed?”

Give employees practical ways to respond

An urgent payment request, an unexpected document share or a message claiming to come from IT support: training should reflect situations your employees encounter in their everyday work.

The Canadian Centre for Cyber Security recommends training tailored to an organization’s needs and employees’ roles, including management. People need to understand the procedures and know how to respond when they suspect a problem.

We recommend making suspicious activity easy to report and reminding employees that it’s always worth raising a concern. Someone who has clicked a suspicious link should know where to turn, without wasting time looking for instructions or worrying about their manager’s reaction.

Ask your IT provider: “If an employee receives a suspicious request or thinks they’ve made a mistake, do they know exactly who to contact?”

Detect unusual activity and decide who responds

Monitoring and activity logs help identify signs of compromise and support incident response. They also help establish what happened.

But an alert needs someone to act on it. Ask which events are monitored, who reviews them and how a potential problem reaches the person authorized to respond. Make sure you also understand what happens outside business hours.

These responsibilities are worth discussing when choosing cybersecurity services for your business.

Ask your IT provider: “If suspicious activity is detected tonight, who reviews it, and who can take action?”

Check that your backups can help you get back to work

A backup needs to let you recover essential information. The Canadian Centre for Cyber Security recommends protecting backup copies, restricting access and regularly testing that restoration works.

Ask for evidence of a recent restoration test and discuss the results in business terms. Which files or systems were recovered? How long did it take? Did the test cover what your team needs for billing, customer service or daily operations?

Recovering a copy of your files and getting employees back to work are two different stages of recovery. That’s why we recommend setting priorities with the people responsible for the affected business activities.

Ask your IT provider: “When did we last test a restoration, and what did we actually get working again?”

Make the first decisions before an emergency

A written incident response plan defines responsibilities, identifies the people to contact and outlines what to do when an incident occurs. It should also address applicable reporting obligations. Its purpose is to make the response more coordinated and limit disruption.

For a small or medium-sized business, we recommend starting with a practical document: who coordinates the response, who communicates with employees and customers, which services take priority and how to reach the right people if your usual email system is unavailable.

Then walk through a scenario with everyone involved. For example: “Our email and business management software have been unavailable since this morning. Who does what?”

This exercise helps uncover decisions that still need to be made before you’re forced to make them under pressure.

Ask your IT provider: “Can we access our response plan if our usual tools are down, and does everyone involved know their role?”

Where should your business start?

If you don’t have answers to several of these questions, start by assessing your current IT environment.

The Canadian Centre for Cyber Security identifies incident response planning, patching, strong authentication and backups as key starting points. These measures should be adapted to your organization’s needs.

An IT security audit can help identify vulnerabilities and establish a prioritized action plan. At Maximiz, this assessment examines both your infrastructure and your practices to give you a clear picture of what needs improvement.

From there, each action should have an owner, a deadline and a way to confirm it has been completed. That gives you concrete follow-through and a clearer understanding of the next steps.

Your technology. We take care of it.

Protecting a business takes ongoing attention. Employees change roles, tools evolve and business needs shift. Your safeguards need to keep pace.

Maximiz supports small and medium-sized businesses across Québec with IT management and cybersecurity, with teams in Sainte-Thérèse, Boucherville and Québec City. Depending on the agreed scope of service, our managed IT services include proactive monitoring, updates and access security.

Our role is to help you understand your priorities and keep your technology properly managed, so you can spend more time running your business.

Want to know which cybersecurity measures your business should prioritize? Talk to our team.

Frequently asked questions about preventing cyberattacks

Can a business prevent every cyberattack?

No security measure can guarantee zero risk. A business can, however, strengthen its protection and prepare its response through a combination of prevention, monitoring and business continuity planning. The goal is to reduce both the likelihood of an incident and its consequences.

Do backups prevent cyberattacks?

Backups help recover data after an incident. They need to be protected, tested and included in a broader cybersecurity approach. Having backups alone does not guarantee that a business can immediately resume all operations.

What should you ask your IT provider after a cyberattack makes the news?

Ask for an overview of your account protections, outstanding patches, monitoring and most recent restoration tests. Also clarify who responds when an incident occurs. Those answers can help you decide what to prioritize next.

Sources and further reading

For more information on the measures discussed in this article, consult the Canadian Centre for Cyber Security resources and the CCQ’s official communication below.

Sources accessed September 3, 2026. Links above lead to the French-language resources used for the original article.

Cyberattack at the CCQ: How Can Your Small Business Reduce Its Risk?