www.convention.qc.ca Listed by ransomhub Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target public venues and event operators as part of a broader pattern of double-extortion attacks that combine encryption with data theft. In this landscape, listings on criminal leak sites serve as pressure tactics even when independent confirmation remains limited. On 5 March 2025, the website www.convention.qc.ca appeared on a list published by the group known as RansomHub, which claimed responsibility for a ransomware incident involving the Quebec City Convention Centre.

Public detail is limited: the number of people affected is unknown, and the only description of what was taken is that internal files were allegedly exfiltrated. The listing itself is a claim by the group rather than a verified disclosure from the organisation. For attendees, exhibitors, staff and partners who have interacted with the centre, the report still warrants attention because convention facilities routinely handle personal, commercial and logistical data.

Breaking down the breach

According to the available record, www.convention.qc.ca was listed by the RansomHub ransomware group on 5 March 2025. The reported summary states that internal files were exfiltrated in a ransomware attack. No further technical details—such as the initial access method, the precise date of intrusion, the volume of data, encryption status, or any ransom demand—have been disclosed in the public facts. The number of individuals potentially affected is listed as unknown. Because the information originates from a threat-actor leak-site claim, it should be treated as unverified until the organisation or independent investigators provide confirmation.

No statements from the Quebec City Convention Centre itself appear in the provided facts, so it is not possible to report whether systems were restored, whether law-enforcement agencies were notified, or whether any data has been released beyond the group’s listing.

Who is ransomhub?

RansomHub is a ransomware operation that became publicly active in 2024 after the disruption of other major groups. It operates a ransomware-as-a-service model in which affiliates conduct intrusions and share proceeds with the core developers. The group is known for double-extortion tactics: after gaining access, operators typically exfiltrate data, encrypt systems, and threaten to publish the stolen material on a dedicated leak site if payment is not made. RansomHub has claimed victims across multiple sectors and geographies, frequently posting sample files or directory listings to increase pressure. Public reporting has associated the group with opportunistic targeting of organisations that hold operational or customer data rather than any single industry focus.

In the present case the only assertion tied to this specific victim is the leak-site listing itself. No additional claims by RansomHub about the content, volume or sensitivity of the files taken from www.convention.qc.ca are recorded in the facts, and none should be assumed.

About www.convention.qc.ca

www.convention.qc.ca is the public website of the Quebec City Convention Centre, a major multi-purpose venue in Quebec, Canada. The centre is among the largest of its kind in the country, offering exhibition halls, meeting rooms and event spaces. It hosts up to roughly 200 events each year and provides services that include event planning, catering and technical support. The facility attracts thousands of attendees from Canada and abroad and emphasises modern infrastructure and environmental commitments.

Organisations of this type routinely manage registration lists, exhibitor contracts, staff and contractor records, payment and invoicing data, floor plans, technical specifications and communications with municipal or tourism partners. A compromise of internal systems can therefore affect both the centre’s operations and the privacy of people who have done business with it.

What was likely exposed

The facts state only that “internal files” were exfiltrated. No inventory of file types, no confirmation of personal identifiers, financial records or credentials, and no sample data have been publicly detailed. Exact contents therefore remain unconfirmed.

In the ordinary course of business a convention centre typically holds names, contact details and organisational affiliations of event organisers, exhibitors and sometimes attendees; contracts and invoices; staff and vendor information; and operational documents such as schedules, floor plans and technical requirements. Whether any of these categories were among the files taken in this incident is not known. Readers should treat any specific data-type claims that circulate without corroboration as unverified.

Why it matters

For individuals, the practical risk depends on what was actually taken. If contact or registration data were included, affected people could face targeted phishing, social-engineering attempts that reference past events, or unwanted commercial contact. If financial or contractual documents were involved, there is a further risk of invoice fraud or identity-related misuse. Because the scale and exact contents are undisclosed, the degree of exposure for any single person cannot be quantified from public information alone.

For the organisation, a ransomware incident can disrupt event operations, damage trust among clients and partners, and create regulatory or contractual obligations under Canadian privacy law. Even when systems are restored, the mere claim of data theft can require notification processes and long-term monitoring. The absence of confirmed numbers does not eliminate these operational and reputational consequences.

What to do if you're exposed

If you have registered for events, exhibited, worked at, or otherwise supplied personal or business information to the Quebec City Convention Centre, treat the listing as a prompt to review your own exposure. Monitor bank and credit-card statements for unexpected charges, enable multi-factor authentication on email and professional accounts, and be sceptical of unsolicited messages that reference past conferences or claim to come from the centre. Change passwords that may have been reused across services. Consider placing a fraud alert with Canadian credit bureaus if you believe financial data could be involved.

You can also run a free exposure scan of your email address against known breach data sets to see whether that address has already appeared in other public incidents. Keep records of any suspicious contact and report confirmed fraud to local authorities and the Canadian Anti-Fraud Centre. Until the organisation or independent investigators release further verified details, these precautionary steps remain the most practical response available to potentially affected individuals.

AICompiled with AI assistance from public sources and published under our editorial standards.