The evolution of Hackfest since 2009
The 18th edition of Hackfest takes place October 29 to 31, 2026, at the Centre des congrès de Québec.
+7
From Consolidation to Services: Driving Cybersecurity with Hackfest...
2025, Bigger, stronger, more Hackfest: 2025 marks a major milestone for POLAR with its move to the Capitole de Québec, an intimate and remarkably beautiful venue. Succulent banquet, thunderous speakers, all in a setting worthy of the event.
In the spirit of innovation that Hackfest embodies, the Hackfest NOW platform is born: a real-time system showing what's happening where at the event, accessible on web, mobile, and displayed on screens throughout the venue.
On the CTF side, we step it up again with a train to hack, and the Physical CTF gets a centerpiece: a 12-foot replica of an atomic bomb weighing over 200 pounds. We never do things halfway. The SCADA/ICS village welcomes a real car, a wind turbine system and an industrial panel, a treat for physical hacking enthusiasts.
The Generations village returns this year in a first collaboration with CyberCap, a great way to open the doors of the community to the next generation.
And to crown it all, 2025 marks the very first edition of Hackfest Afterdark on Saturday night: podcast, the Hacker Charlatan game, and a nocturnal social engineering contest open to all 18+ with no preparation, no advance knowledge of the target. Extreme? Absolutely. A wild success? Without a doubt.
+5
From Awareness to Action: Strengthening Cybersecurity at Hackfest ...
2024, Nearing perfection: 2024 is a return to basics. No drama, no chaos, just Hackfest at its best. POLAR matures with a superb stage and exceptional speakers, and musical performances make their grand return at the convention center.
On the activities side, Hackfest continues to grow and innovates with the first Physical CTF in its history. Participants must first qualify by opening a door as fast as possible and defusing a fake bomb: cut the right wire, not the wrong one. Qualifiers then access a life-size hacking escape room: infiltrate a room without being detected, hack cameras, reconstruct passwords from shredded paper, and more.
2024 also introduces a village built around a full 3D scale model of a bank heist. Participants must figure out how to pull off the robbery by combining multiple technologies and bypassing every security system in their way. A challenge as creative as it is immersive.
The CTF also welcomes a real SCADA/ICS track with a prize of up to $5000 for those who find all the flags.
The feedback is unanimous: 2024 is the best year of Hackfest. A nice problem to have.
+5
Taking computer security into the future with a Back to the Future movie theme...
What we can say is that for participants, it was a superb edition. 2023 sees the birth of the startup showcase and the very first edition of POLAR, an event for cybersecurity managers that has sold out every year since its launch.
For a lighter story, let's talk about the Social Engineering Village booth. This custom-built booth is made of four panes, a floor, a roof and four posts to hold it all. That year, the four posts mysteriously disappeared. The booth held up on its own, oddly wedged between the stage cracks. Whatever it takes!
2023 was technically a transition year, despite all the challenges behind the scenes. Hackfest moved forward, no matter what.
+4
We're back in person with an edition well set up in what will be the new Plaza.... the Quebec City convention center.
2022, The return in person, chaos edition: 2022, finally back in person! But reality could have been very different. The initial idea was to stay in a hotel to preserve that intimate Hackfest vibe, with rooms close to the conferences. After eight months of negotiation with a certain hotel, spreadsheets describing the event hour by hour, room by room, day by day, who does what where, the team received a contract less than two months before the event where 80% of the content didn't match what had been agreed. After a day of debate within the committee, the decision was made: we abandon and find something else, six weeks before the event.
Next came a visit to the convention center and the Vidéotron Centre. Yes, Hackfest almost landed at the Vidéotron Centre, it was even the top choice until the financial proposal arrived.
The convention center was finally a pleasant surprise: simple and efficient management, a terrific team, and 80% less effort for setup. We wouldn't have believed it would go so well.
Among the edition's savory highlights, the Quebec government became a partner and Mr. Éric Caire delivered the opening. And for the occasion, money from another country was distributed to the government and some industry players, in a well-aimed sarcastic joke to illustrate that our money had lost much of its value. The photos speak for themselves.
And despite all this chaos behind the scenes, the edition was a resounding success and the number of participants was back on the rise.
+1
Another online edition...
2021, Virtual fatigue: 2021, still online. The edition is better organized than ever, the system is more refined, management is smoother, but the hype is gone. Everyone is exhausted from virtual, between Zoom jobs, curfews and endless isolation. Participation drops, and it's understandable.
The story of this year is as short as the general interest in online events at that time. The talks and workshops were excellent, but that's it.
The 2020 edition was an online edition due to the COVID-19 pandemic.
2020, The pandemic crashes Hackfest: Uh oh. The pandemic upends everything, and Hackfest goes online for the first time in its history. In another timeline, the 2020 edition would have been held at the Hôtel Le Concorde in Quebec City: everything was negotiated: months of organizing, signed contracts, site visits. Everything was cancelled, which turned out for the best, or almost. We'll come back to that in 2023.
Despite it all, this first online edition was a resounding success. The community, isolated for months, reconnected with overflowing enthusiasm, and the Hackfest Discord community grew explosively. Join us: discord.hackfest.ca
And even online, we don't do things halfway. Villages were there in workshop format: AWS Village, Hardware Hacking Village, ICS Village, IoT Village, and the Wonderful Village of Mental Security. The virtual format didn't dampen the Hackfest spirit.
+4
Breach after breach, as 2019 passed Quebecers among many others gradually realized certain issues of personal information protection...
2019, The peak before the storm: 2019 sees the birth of an initiative that would have an impact far beyond Hackfest's walls. Steve Waterhouse and Patrick Mathieu scan government infrastructure to expose its obsolescence, and it was great. This initiative, now known as hack-canada.ca, marks the start of concrete efforts that would lead to the creation of CERT/AQ, then MCN, with significant improvements in government security, a bug bounty program and more.
The CTF also innovates with the introduction of an electronic badge, an addition that was an immediate hit with participants.
2019 will also remain the pre-pandemic record edition, with 1600 participants gathered at the Plaza. A number that wouldn't be matched until 2024 and surpassed in 2025, but that's another story.
+2
Hackfest celebrates its 10th edition with the 'Decade' theme. A historic moment for the Quebec cybersecurity community.
2018, DECADE, 10 years of Hackfest: 2018 is the 10th anniversary edition, and we don't do things halfway. The event grows like never before with a multitude of villages: Internet of Things, Social Engineering Contest, Soldering, RFID, Hardware Hacking, Hackfest RSA NoC, and even Virtual Reality. On the CTF side, we're busy too with Hackfest CTF, Missing CTF, OWASP CTF, Security Innovation CTF and the legendary BrainFuck. XXL programming for an anniversary edition.
This year, Minister Karina Gould takes the stage and calls on hackers to help her. News welcomed by the community with enthusiasm... which unfortunately led nowhere. So it goes with politics.
2018 also marks the beginning of special edition Hackfest t-shirts, with an artist illustrating the Sentinel destroying the Château Frontenac. A collector's item for event regulars.
And then there's Johnny Xmas. At every Hackfest, our dear colleague sits at the bar for a game of quarters against the bartender. To this day he's the only one to have racked up so many wins, even going home with a trophy. For the juicy details, go ask him directly!
+2
The 'Nine Lives' edition explores the theme of resilience in cybersecurity, inspired by the legendary nine lives of a cat.
2017, A founding year: 2017 marks a historic first: Hackfest becomes the first and still the only social engineering contest in Canada. Inspired by the Def Con format but improved, participants take their place in a plexiglass box, in front of the crowd, and make real phone calls to real companies. All hosted by the one and only Shane, the only one to have won the Def Con contest twice. A moment both fascinating and intense.
It's also the year villages were born at Hackfest, starting with an RFID village, a formula that would expand in the following editions.
2017 also marks the first Hackfest party with a real musical performance: DualCore joins us for a memorable evening. The shows would return in 2024 at the convention center, but this is where it all began.
This year also begins a beautiful tradition: offering a Chic Choc shooter to each new speaker, a very Quebec way of welcoming those who take our stage for the first time.
On a sadder note, the 2017 edition was dedicated to our dear colleague from Hackfest and La French Connection, Steven 'loneferret' McElrea. A thought for him who marked our community.
The 'Infinity' theme symbolizes the never-ending evolution of cybersecurity and the infinite possibilities available to the community.
2016...Explosive, literally: 2016 gives us a third mockup, and this time we're playing in the big leagues: a fake bomb with a liquid, alcohol, that mixes and explodes like in a Die Hard movie. But the design of this mockup almost went sour. SMS exchanges during planning, the word 'bomb' taken out of context, and someone, having forgotten who they were talking to, calls the police. Everything ended well.
This year also marks a first for CTF winners: a 3D-printed Sentinel trophy, a tradition that would leave a lasting impression.
On the partner zone side, a safe to pick had been planned, agreed at about two feet by two for a maximum of 20 pounds. What arrived was something else entirely: a behemoth of over 200 pounds that required four people to put in place. It almost never found its spot, and the spectacle of the move was worth the trip alone.
On a much darker note, a speaker allegedly struck his partner before fleeing through the hotel corridors around 3am, at the end of Hackfest, to escape the police. He was allegedly arrested and his passport seized for a few days. We don't know what became of him, but one thing is certain: he's banned from the event.
+4
The 7th edition of Hackfest plays on the luck theme with 'Lucky 7', while demonstrating that security cannot be left to chance.
2015: Always ahead: 2015 confirms once again that Hackfest likes to lead the way. In collaboration with OWASP Montréal and several well-known figures from the Quebec community, Hackfest creates the first hacking event in eSport format. About fifty players participate in a qualification phase, with four to six teams competing in the final, broadcast live on Google Meet and commented by a dedicated team. The activity was a resounding success and would be repeated for several years.
This year also sees the birth of the second major Hackfest mockup, and we step it up: this time it's a gas pipeline controlled by industrial electronic equipment that's made available to participants to hack. A new demonstration of Hackfest's unique know-how in making hacking concrete and spectacular.
+2
Hackfest makes its 'Return' with a renewed edition, confirming its place as the must-attend cybersecurity event in Quebec.
2014: A year of firsts: 2014 brings us Theo de Raadt as a speaker, a presentation that remains to this day one of our most-viewed YouTube videos. We also welcome a former CIA agent who managed disguises within the organization, a presence that didn't go unnoticed in the room.
We also had the first nerf gun lockpicking challenge, and a rather particular version of the contest: two participants handcuffed together to a hotel cart. The start was memorable, the two competitors bumping heads as they bent simultaneously to start freeing themselves. A must-see: https://www.youtube.com/watch?v=hmMuGNfrZ3s
And to crown it all, Renderman receives Murdoch the monkey on stage, Hackfest being the first event to honor this request as particular as it was memorable from the speaker.
That year was also marked by an incident we could have done without. A certain consultant, now behind bars, had stolen a bottle of wine and broken a refrigerator in the Plaza kitchen. To crown it all, he had lied to our staff claiming the bottle belonged to him. We know better now.
+5
With 'Strikes Back', Hackfest returns stronger than ever, inspired by science fiction and themes of resistance and counter-attack.
2013: The year of the mockup: 2013 will be remembered as the year of the first version of the famous mockup. Hackfest is among the first events in the world to set up a real connected and hackable mockup. And since we're in Quebec, we do things our way: a hydroelectric dam overflowing onto a village, and a USB missile launcher to crown it all. Shh, don't say it too loud, but several major organizations, including SANS, set up a very similar concept a year or two later. We can be proud.
On the drama side, 2013 doesn't disappoint. A speaker shows up in such a state that he delivers a particularly poor presentation. Rumors have it anyway that this wasn't his last performance of that caliber at other conferences in the following years.
The edition also offers us some memorable scenes: photos of participants asleep alone in the conference room, and someone who spent the night under a partner table. Oops.
This year, magikh0e also presents his talk on hardware hacking, 'Warranty Voiding Techniques'. In the middle of the presentation, a friend bursts onto the stage to bring him a 'lab coat'... which turns out to be a hotel bathrobe. A memorable moment you can relive here: https://youtu.be/zYR3pPPvlEk?si=T6uPGYRqMKtofxj3
But 2013 is also the birth of the first nocturnal workshops. The legendary Whiskey and Qubes OS workshop hosted by Danny, and the hardware workshop with Dimitri, two rendezvous that would lay the foundations of a tradition well anchored in Hackfest's DNA.
+4
The 'Matrix' edition immerses participants in the cyberpunk universe made famous by the cult film. Reality vs simulation, red pill or blue pill?
2012: The Plaza era begins: In 2012, Hackfest takes a new step and moves to the Plaza Hotel, a venue that would accompany it for many years and allow the event to grow from 450 participants to 1600 in 2019. A visionary choice for an event that never stops growing.
The edition welcomes two heavyweights from the international scene: Dave Kennedy, now CEO of several security companies in the US and known for the Social Engineering Toolkit, as well as Jim Manico, a leading figure at OWASP. Fun fact: Jim had found his favorite spot in the hotel: the pool area, whose heat and humidity reminded him of Hawaii.
2012 also sees the birth of iHack, the mid-year event launched at Cégep Sainte-Foy, which would become over time a multi-city event across Quebec and Ontario. In their eagerness, the team decided to organize two or three the same year, bringing the total to four or five CTFs to produce in a single year. Suffice to say wisdom wasn't in attendance. The multi-iHack format was fortunately abandoned after a year or two.
On the CTF side, the Enterprise Reality format goes to the next level. Gone are the two teams, place for a worldwide simulation: about eight countries competing, with local infrastructures, banks, a black market and more. The war of nations was declared.
This year also marks a first of another kind: media cameras make their appearance on site, and Hackfest appears in the news. The event leaves the underground for good to enter the public sphere. And as if 2012 wasn't enough to mark minds, the Hackfest family also grows outside the conference rooms, with the arrival of a first child for a committee member. A fine year indeed.
+3
A tribute to the cult 1995 film 'Hackers', this edition celebrates 90s hacker culture with its neon aesthetic and electronic soundtrack.
2011: The legend takes shape: The edition now reaches 300 participants at full capacity, and it's also the year that sees the birth of a legendary tradition: the BrainFuck game, the emblematic Hackfest puzzle that would become a must over the years.
The HackerSpace, ancestor of QuebecSec: 2011 marks one year since the creation of the HackerSpace. The famous Cage aux Sports meetings evolved into an official meeting at Laval University, a nice consecration for a community that had never stopped growing since the informal beginnings of the 90s.
This year also marks the beginning of an unprecedented CTF format: 'Enterprise Reality'. The concept is simple but formidable: two teams of 20 people compete, each having to simultaneously attack the opposing infrastructure and defend their own. Each participant has a well-defined role: president with no network access, sysadmin, and so on. But the real stroke of genius? A spy infiltrated in each team, who must stay discreet without being unmasked. The war was fierce, and the format left lasting memories.
But 2011 is also a new anecdote that enters the annals. A speaker decides to spice up his presentation with a participatory game: for each error or missing detail, the crowd can shout for him to drink. Small problem: alcohol outside the hotel isn't allowed. So he ends up drinking... from a water bottle. For those who still wouldn't get it, water is transparent. But water isn't the only thing that's transparent.
+1
Inspired by Daft Punk, the 'Harder Better Faster Stronger' edition symbolizes the constant evolution required in cybersecurity.
2010: A new chapter at the Classique Hotel: The 2010 edition also marks the transition to a full two-day format, with two CTFs, one per night, hosted by DJs to keep participants awake all night. Yes, we were maybe a bit crazy back then: planning two on-site CTFs with on-prem servers simultaneously was quite a challenge. But it's exactly this kind of organized madness that forges Hackfest's DNA.
The 2010 edition also marks the transition to a full two-day format, with two CTFs, one per night, hosted by DJs to keep participants awake all night. Yes, we were maybe a bit crazy back then. Planning two on-site CTFs with on-prem servers simultaneously was quite a challenge. But it's exactly this kind of organized madness that forges Hackfest's DNA.
That year we also met a certain speaker we had to go wake up in his room 10 minutes before his talk. Despite it all, he managed to get on stage and deliver his presentation, even if his appearance betrayed without equivocation the excesses of the night before. A founding anecdote, among so many others, that illustrates the unique vibe of these early editions.
+1
The first edition of Hackfest launches in Quebec City with the 'Reloaded' theme. The beginning of a great adventure for the Quebec cybersecurity community.
At the origins: Long before Hackfest existed, a community of cybersecurity enthusiasts was already gathering. In the late 90s, it was around e-zines and wardriving sessions that the first links were forged. In the early 2000s, these meetings grew: the QC2600 group met at 2600 Laurier, then at the Cage aux Sports, laying the foundations for what would eventually become a HackerSpace.
The birth of Hackfest: It was at Laval University, with the student events of the C.E.N.T.I.N.E.L group, that the idea of Hackfest was born. In November 2009, the first edition of Hackfest took place: Hackfest 2009, also known as the R3LOADED Edition, was born. In the aftermath, the entity was formalized as a non-profit organization.
The first ordeal: The H1N1 pandemic hit the organization hard: Hackfest lost its room at Laval University. No matter: the event moved to the basement of the Universal Hotel, proving from its very beginnings that the Hackfest community doesn't let itself be stopped easily.
Thank you to every participant, sponsor and volunteer who made the 18th edition a success. We can't wait to see you again!
For 2027, Hackfest 19 takes the game of Go as its theme. A Go board has 19 lines by 19, just like this 19th edition. In the logo, five HF stones form the glider from Conway's Game of Life, a hacker emblem. The last stone is placed by a robot hand: that is AI, which now plays alongside us. See you October 21 to 23, 2027.
