Montmorency College Listed by avoslocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target educational institutions, drawn by large stores of personal data and the operational pressure that can accompany disruption of academic calendars. In late 2022, Collège Montmorency appeared on a leak site operated by the AvosLocker ransomware group, adding the Quebec CEGEP to a lengthening list of schools and colleges whose internal systems have been claimed as compromised.

Public reporting and the group's own listing describe an incident in which internal files were allegedly exfiltrated. The number of people affected remains unknown, and many operational details have not been independently confirmed. For students, staff and alumni, the episode underscores the real-world stakes when educational records become bargaining chips in a ransomware campaign.

Breaking down the breach

According to available records, Montmorency College was listed by the AvosLocker ransomware group on or about 26 December 2022. The listing and accompanying claims state that internal files were exfiltrated in a ransomware attack and that approximately 8 TB of personal data had been compromised. The group asserted that the college's board of directors should make contact to avoid a full publication of the material on the group's blog.

Contemporary news coverage from May 2022 had already noted a cyberattack at the college and the possibility that personal data had been stolen. The precise timeline between the initial intrusion, any encryption event, the claimed exfiltration and the December leak-site posting is not fully detailed in the public record. The scale of individuals affected is listed as unknown, and the specific technical method of initial access has not been disclosed in the materials reviewed here.

The group's statements remain claims until independently verified. No confirmed figure for ransoms paid or refused, nor a definitive inventory of every file taken, appears in the summarised facts.

Who is avoslocker?

AvosLocker is a ransomware operation that emerged in the early 2020s and became known for double-extortion tactics: encrypting systems while also copying data and threatening to publish it if payment is not made. The group has typically operated a Tor-based leak site on which it names victims, posts samples or full archives, and sets deadlines. Affiliates have been observed using common intrusion paths such as compromised remote-access services and unpatched vulnerabilities, followed by lateral movement and data staging before ransomware deployment.

Like other ransomware brands of that period, AvosLocker focused on organisations whose downtime or data exposure would create strong incentives to negotiate. Educational institutions, healthcare providers and mid-sized enterprises have all appeared on its listings. In this case, the group claimed responsibility for the Montmorency College incident and used the familiar pressure language of imminent full disclosure. No additional claims specific to this victim beyond the listing and the stated volume of data are treated here as established fact.

Who is Montmorency College?

Collège Montmorency is a public CEGEP (collège d'enseignement général et professionnel) located in Laval, Quebec. CEGEPs occupy a distinctive place in the Quebec education system, bridging secondary school and university or the workforce; they enrol large numbers of young adults and maintain extensive administrative, academic and student-services records.

Institutions of this type routinely hold student biographical and contact information, academic transcripts, financial-aid and tuition records, employee personnel files, and operational documents. A breach affecting such an organisation is consequential because the data often remains relevant for years—supporting applications to universities, professional licensing, employment background checks and government services—and because the affected population includes minors or recent minors whose information requires careful handling.

What was likely exposed

The facts name the exposed material as internal files exfiltrated in a ransomware attack, with the group's claim placing the volume at roughly 8 TB of personal data. Exact data types, file inventories and the identities of individuals whose records were taken have not been itemised in the disclosed summary.

Organisations such as CEGEPs typically maintain student information systems, human-resources databases, email archives, financial systems and shared document repositories. These can contain names, dates of birth, addresses, student numbers, grades, health-related accommodations, banking or payment details for tuition, and staff employment data. Because the precise contents remain unconfirmed, it is not possible to state which of these categories, if any, were included in the claimed exfiltration. Readers should treat any specific assertion about particular data elements as unverified unless the college or a competent authority later publishes a confirmed inventory.

The real-world impact

For individuals, the principal risks are identity fraud, targeted phishing and long-term misuse of academic or personal identifiers. Even partial records—names paired with student numbers, addresses or dates of birth—can be combined with other breached data sets to support account takeover or social-engineering attempts. Staff whose personnel files were involved may face similar exposure of employment and financial information.

For the college, consequences can include regulatory notification duties, costs of investigation and remediation, reputational harm, and the operational burden of supporting affected students and employees. Educational institutions often operate with constrained cybersecurity budgets and complex legacy systems, which can prolong recovery. The incident also illustrates the broader pressure ransomware places on the education sector: academic continuity, privacy obligations and the welfare of a young adult population all intersect when systems and data are held hostage.

No public confirmation of the final disposition of the claimed data—whether it was published in full, partially released, or withheld—is contained in the facts provided.

Were you affected?

If you are a current or former student, employee or contractor of Collège Montmorency, treat the possibility of exposure seriously even though the exact scope remains unknown. Monitor financial and academic accounts for unusual activity, enable multi-factor authentication wherever it is offered, and be alert to phishing messages that reference the college or request urgent action. Consider placing fraud alerts with credit bureaus if you believe sensitive identifiers may have been involved. Official updates should be sought from the college itself rather than from unverified third parties.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for personal monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.