Qeco/coeq Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 10, 2024, the Qualifications Evaluation Council of Ontario, known as Qeco or coeq, was listed by the rhysida ransomware group. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and further details about the incident have not been disclosed. This matters because Qeco administers the evaluation of teacher qualifications used for salary purposes across Ontario’s education sector, handling records that can affect educators’ professional standing and compensation.

The listing itself is a claim by the threat actor rather than an independently verified confirmation of every asserted detail. What is established so far is limited: an organization responsible for objective qualification assessments was named on a ransomware leak site after an apparent data-exfiltration event.

What happened

According to available public information, Qeco/coeq was listed by the rhysida ransomware group on September 10, 2024. The reported summary states that internal files were exfiltrated in a ransomware attack. No further specifics have been released about the precise timing of the intrusion, the technical method used to gain access, the volume of data taken, or any ransom demand. The number of individuals whose information may have been involved is listed as unknown. Public detail is therefore limited to the fact of the listing and the description of internal-file exfiltration; claims of broader impact or specific file contents remain unconfirmed outside the group’s own assertions.

The group behind it: rhysida

Rhysida is a ransomware operation that has been publicly documented since mid-2023. The group typically employs a double-extortion model: it encrypts systems and simultaneously steals data, then threatens to publish the stolen material on a dedicated leak site if payment is not made. Rhysida has previously targeted a range of sectors, including education, healthcare, government, and private enterprise, often posting victim names and sample files to pressure organizations. Its operators are known to use standard ransomware tooling combined with data-theft techniques, and they maintain a Tor-based site where they list claimed victims. In this case, the appearance of Qeco/coeq on that site constitutes the group’s claim that it successfully exfiltrated internal files; independent verification of the full scope has not been published in the available record.

Who is Qeco/coeq?

Qeco, also referred to as coeq or the Qualifications Evaluation Council of Ontario, was founded in 1969 by the Ontario English Catholic Teachers’ Association (OECTA), the Elementary Teachers’ Federation of Ontario (then comprising FWTAO and OPSTF), and the Association des enseignantes et des enseignants franco-ontariens (AEFO). Its core function is to provide and objectively administer the evaluation of teacher qualifications for salary purposes. Organizations of this type maintain records of educators’ credentials, course completions, and related professional documentation so that school boards can place teachers on the correct salary grids. Because these evaluations directly influence compensation and career progression for teachers across Ontario, the body holds sensitive professional and personal information that is consequential both to individual educators and to the wider public-education system.

What was likely exposed

The facts state that internal files were exfiltrated in the ransomware attack. No more granular inventory of data types—such as specific categories of personal identifiers, salary records, or credential documents—has been disclosed. Organizations that evaluate teacher qualifications typically hold materials including names, contact details, educational transcripts, certification histories, and correspondence related to salary-category placements. Whether any or all of those categories were among the internal files taken in this incident remains unconfirmed. Public reporting does not name exact file names, record counts, or data fields, so any assumption about precise contents would be speculative.

Why it matters

For educators whose records may have been involved, the primary risks are identity-related misuse and professional disruption. Stolen internal files could contain enough personal and credential information to enable targeted phishing, fraudulent applications, or attempts to alter salary-related documentation. Even without confirmed identity-theft cases, the mere exposure of professional evaluation data can create lasting uncertainty for individuals who rely on accurate qualification records for employment and pay. For Qeco itself, the incident raises operational and reputational questions: the organization must determine the integrity of its systems, notify affected parties if required, and restore confidence that qualification assessments remain secure and objective. Because the number of people affected is unknown, the full scale of individual impact cannot yet be measured, but the nature of the data typically held by such a body makes the event material to Ontario’s teaching workforce.

If your data was in this claimed breach

If you are a teacher or education professional who has submitted materials to Qeco for qualification evaluation, treat the possibility of exposure seriously even while exact contents remain unconfirmed. Begin by monitoring financial and professional accounts for unusual activity, and consider placing fraud alerts with credit-reporting agencies if you believe sensitive identifiers may have been involved. Change passwords on any accounts that reuse credentials linked to your professional email, and enable multi-factor authentication wherever available. Review correspondence from Qeco or your school board for official notifications about the incident. As a practical next step, you can run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets; such a scan provides an additional data point but does not replace official guidance from the organization itself. Continue to follow any updates released by Qeco or relevant authorities rather than relying solely on third-party claims.

AICompiled with AI assistance from public sources and published under our editorial standards.