BQ Leader Blanchet bungled social media hacking incident, former cybersecurity official says

Bloc Québécois leader Yves-François Blanchet's X account raised eyebrows after suspicious posts were shared. Photo by Evan Buhler /Montreal Gazette

Article content

The Bloc Québécois missed an opportunity to own up to the mistakes of its leader, Yves-François Blanchet, and educate voters about best online practices after Blanchet’s X account was hacked nearly two weeks ago, said one of the province’s leading cybersecurity advisers.

Article content

Steve Waterhouse, former Quebec assistant minister of information security and cybersecurity, said the political party instead “downplayed” the whole event by not addressing an apparent cryptocurrency scam that ran on Blanchet’s account for 11 days.

Article content

Article content

Article content

“You have the integrity of the leader of the party that’s being drawn into the public attention, not for the right reasons. To then leave the event be as is and not make a big fuss about it, to me, says that he doesn’t understand the threat,” Waterhouse said.

Article content

Article content

The first suspicious post on Blanchet’s X account took place on July 11, promoting a cryptocurrency influencer and a supposed claim from the BQ leader that he had made tens of thousands of dollars thanks to her help. The tweet was promptly deleted.

Article content

Earlier this week, Blanchet’s X account raised more eyebrows after it showed an English-only post which accompanied pictures of him touring areas of Quebec, an unlikely occurrence for the Bloc leader who usually only posts in French.

Article content

Shortly after, two other posts related to the cryptocurrency scam reappeared on Blanchet’s X account, forcing the political party to admit their leader had been hacked.

Article content

“We invite the population to click on none of the links on publications related to cryptocurrency and any other link until notified to the contrary by the Bloc Québécois,” Blanchet’s spokeswoman, Joanie Riopel, said in a statement on Tuesday.

Article content

Article content

Riopel added that the party was counting on the prompt collaboration of X to resolve the situation as soon as possible.

Article content

Article content

On Friday, the Bloc announced that its leader’s X account was back and running and Blanchet posted a circumspect post: “With prudence and caution, I am making a publication on my personal page (which is now) restored and recovered,” he wrote on X Friday morning in French. “We will know in the coming hours and coming days if the account has been correctly restored.”

Article content

Waterhouse said the situation underlines that Blanchet was probably not using best online security practices. His account may have been hijacked either by a simple password hack, or one of the devices on which he was managing his account was compromised, he said.

Article content

Either way, Waterhouse said Blanchet should have owned up to his mistake.

Article content

“For me, it would have been a great opportunity for him to just say, ‘Listen, people, this happened to me… Please make sure you apply best practices by making sure you have a good password, to multi-factor authentication, and so on,” the expert said.

Article content

Waterhouse said it would have been an educational moment for Blanchet’s more than 54,000 followers on X, some of which may have been fooled by the cryptocurrency scam.