On September 10, 2024, the Qualifications Evaluation Council of Ontario, known as QECO/coeq, appeared on the leak site of the Rhysida ransomware group. The organization, founded in 1969 by major Ontario teacher federations to evaluate educator qualifications for salary purposes, may have had its internal files exfiltrated during a ransomware attack. The listing does not specify the number of records affected or detail exactly which documents were taken.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Qualifications Evaluation Council of Ontario
Get alerted the next time Qualifications Evaluation Council of Ontario files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Qualifications Evaluation Council of Ontario’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details from the Leak Site
The primary disclosure on the Rhysida leak portal states that QECO/coeq suffered a ransomware incident and that attackers successfully exfiltrated internal files. No sample data has been publicly posted yet, and the listing does not quantify the volume of material taken or name specific systems breached. The disclosure indicates the data is now held by the group for potential extortion purposes. Public reporting on Rhysida shows the group typically uses this stage to pressure victims into payment by threatening to publish sensitive corporate or member information.
Why This Matters for You and Your Family
If you are an Ontario teacher, retired educator, or administrator whose qualification records, salary grids, or personal details sit with QECO, this claimed breach could expose information that links your professional identity to your home address, phone number, or date of birth. Even though the exact data types remain unknown, internal files exfiltrated in ransomware attacks frequently contain spreadsheets, scanned documents, and email archives that attackers can weaponize. For families, a single exposed record can serve as the starting point for phishing campaigns, loan fraud, or targeted harassment years after the initial incident.
The Doxxing and Identity-Chain Risk
Ransomware leaks like this one rarely stop at the corporate perimeter. Once internal files leave QECO’s control, they can be cross-referenced with other breaches to build detailed profiles. A teacher’s work email combined with a spouse’s phone number or a child’s school-related record creates an identity chain that stretches into gaming accounts, social-media handles, and family cloud storage. These chains allow criminals to hijack accounts, impersonate family members, or sell the bundle on underground markets. Credential leaks of this nature frequently cascade into account takeovers precisely because the same passwords or recovery details appear across professional and personal services.