Cyber Incident Victim: Qualinet
Date:
Nov 2025
Location:
Canada
Summary
Qualinet experienced a data theft during a cyberattack that prompted activation of its emergency plan and mobilization of specialist teams. After restoring systems, the company confirmed that some data had been exfiltrated and notified affected individuals in compliance with Law 25, while the case was transferred to the Quebec City police and the Quebec Access to Information Commission. Leadership emphasized transparency and urged broader awareness of cyber threats among businesses.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Early in the winter of 2025, Qualinet experienced a cyberattack that resulted in the theft of data from its systems. Upon detecting the incident, the company activated its emergency response plan and mobilized a team of specialists to assess the scope of the breach. After an initial analysis, Qualinet reported that it had been able to restore its operational systems. The company also confirmed that certain data had been exfiltrated during the attack.
In accordance with Quebec’s Law 25, Qualinet began notifying affected clients about the data theft. The matter was handed over to the Service de police de la Ville de Québec for investigation, and the Commission d’accès à l’information du Québec was informed of the incident. Company officials, including operations director Roger Vigneault and president Éric Pichette, stated that the disclosure was made to maintain transparency and to encourage broader awareness of cyber threats among businesses. Pichette noted that attackers are increasingly using artificial intelligence to identify targets and exploit vulnerabilities. He also referenced a Canadian Internet Registration Authority survey from August 2024 indicating that 44 percent of Canadian organizations had suffered a cyberattack in the preceding year.
Qualinet has not granted interview requests regarding the incident, and the investigation remains under the authority of the SPVQ. The company emphasized that it continues to take precautionary measures to protect client data. No further details about the specific data compromised or the attackers’ identity have been disclosed in the available sources.