A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

An employee at Sidney’s Thrifty Foods tested positive for COVID-19, the parent company Sobeys posted on its website Wednesday. (Wolf Depner/News Staff)
COVID-19 case reported at Sidney grocery store

Thrifty Foods employee last worked at the store April 3

Despite a staff recommendation supporting for what would have been Sidney’s third retail location for recreational cannabis, council signalled its opposition to the application by a vote of 5-2. The proposed store would have been located in the 9700-block on Third Street sharing space with other businesses. (Black Press Media File)
Sidney rejects proposal for third cannabis location in community

Application from Jima Cannabis to open a store in 9700-block of Third Street goes down by 5-2 vote

A Sooke man died Tuesday afternoon after his car left the roadway in 7500-block of West Coast Road around 1:30 p.m. and hit a tree. (Black Press Media file photo)
Sooke man dies in Tuesday crash on West Coast Road

The man’s SUV left the roadway and struck a tree

Madison soaks up the sunshine with her family at at Langford Lake on April 5. (Dawn Gibson/News Staff)
PHOTOS: Langford residents hit the beach

Environment Canada predicting temperatures into the low 20s this weekend

(Black Press Media file photo)
Privacy concerns keep COVID-19 cases at University of Victoria off the record

Island Health, UVic not sharing specifics after internal notice confirms coronavirus case

(Black Press Media file photo)
POLL: Do you have a plan in place in the event of a tsunami?

Tsunamis have claimed the lives of more than 250,000 people between 1998… Continue reading

Anyone with information on any of these individuals is asked to call 1-800-222-TIPS (8477) or visit the website victoriacrimestoppers.ca for more information.
Greater Victoria Crime Stoppers wanted list for the week of April 13

Greater Victoria Crime Stoppers is seeking the public’s help in locating the… Continue reading

Commercial trucks head south towards the Pacific Highway border crossing Wednesday (April 14, 2021). The union representing Canadian border officers wants its members to be included on the frontline priority list for the COVID-19 vaccine. (Aaron Hinks photo)
CBSA officers’ union calls for vaccine priority in B.C.

Border officers at ports including, YVR and land crossings should ‘not be left behind’

One of the grand prizes for this year's Hometown Heroes Lottery includes a seaside home at SookePoint, $1.5 million, and an Audi Quattro. (Photo courtesy of Hometown Heroes)
Hometown Heroes Lottery features seaside home in Sooke

A stunning seaside home in Sooke could be yours for the price… Continue reading

City workers from Duncan were busy recently putting up street signs in both Hul’q’umi’num’ and English. (Submitted photo)
Hul’q’umi’num street signs installed in downtown Duncan

Partnership with Cowichan Tribes sees English street names twinned with Indigenous language

Homicide investigators who asked not to be identified put up signs Wednesday, April 14, along the Nanaimo Parkway in the area where a body was found March 31. RCMP are asking for witnesses or dash cam footage as the suspicious death has now been ruled a homicide. (Chris Bush/News Bulletin)
Suspicious death along the highway in Nanaimo now being investigated as a homicide

RCMP identify victim as Randell Charles Thomas, repeat call for any information related to the case

A still from the video taken of a violent arrest on May 30, 2020 in downtown Kelowna. (File)
Kelowna Mountie charged with assault for caught-on-camera violent arrest

Const. Siggy Pietrzak was filmed punching a suspected impaired driver at least 10 times during an arrest

A screenshot from a Nuu-chah-nulth healing song and performance created in collaboration between Hjalmer Wenstob and Timmy Masso. (Screenshot from YouTube)
WATCH: Tla-o-qui-aht First Nation brothers produce COVID-19 healing song

Hjalmer Wenstob and Timmy Masso share dance and inspiration.

Most Read