A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

People skate on a lake in a city park in Montreal, Sunday, January 10, 2021. THE CANADIAN PRESS/Graham Hughes
The end of hugs: How COVID-19 has changed daily life a year after Canada’s 1st case

Today marks the one year anniversary of COVID-19 landing in Canada

Myrna Norman credits social activity for her success fighting dementia. (Special to The News)
Maple Ridge woman writes inspirational book documenting living with dementia

Myrna Norman has been an active community advocate for de-stigmatizing the debilitating disease

Betty Dubé with her daughters, campaigned for Maple Ridge mayor and was elected in 1974. (Maple Ridge Museum)
LOOKING BACK: Women involved in Maple Ridge politics for decades

A look at local women in public office as the U.S. inaugurates its first female vice president

Police tape is shown in Toronto Tuesday, May 2, 2017. (Graeme Roy/The Canadian Press)
CRIME STOPPERS: ‘Most wanted’ for the week of Jan. 24

Crime Stoppers’ weekly list based on information provided by police investigators

A health-care worker prepares a dose of the Pfizer-BioNTech COVID-19 vaccine at a UHN COVID-19 vaccine clinic January 7, 2021. THE CANADIAN PRESS/Nathan Denette
Employers might be able to require COVID-19 vaccination from employees: B.C. lawyer

‘An employer must make the case’ using expert science, explains lawyer David Mardiros

Terrance Josephson of the Princeton Posse, at left, and Tyson Conroy of the Summerland Steam clash during a Junior B hockey game at the Summerland Arena in the early spring of 2020. (John Arendt - Summerland Review)
QUIZ: How much do you know about hockey?

Test your knowledge of Canada’s national winter sport

Hundreds participated in the Abbotsford Kisaan Tractor Rally on Sunday. (John Morrow/Abbotsford News)
Tractor rally in Abbotsford draws hundreds

Abbotsford Kisaan Tractor Rally occurs on Sunday

Beds are set up at the emergency response centre at the North Surrey Recreation Centre. (Contributed file photo)
26 people test positive for COVID-19 at Surrey emergency shelter

Centre located at North Surrey Recreation Centre

The fine for changing lanes or merging over a solid line costs drivers $109 and two penalty points in B.C. (Screenshot via Google Street View)
B.C. drivers caught crossing, merging over solid white lines face hefty fine

Ticket for $109, two penalty points issued under Motor Vehicle Act for crossing solid lines

Cannabis bought in British Columbia (Ashley Wadhwani/Black Press Media)
Is it time to start thinking about greener ways to package cannabis?

Packaging suppliers are still figuring eco-friendly and affordable packaging options that fit the mandates of Cannabis Regulations

A registered nurse prepares a dose of the Moderna COVID-19 vaccine in Halifax on Monday, Jan. 11, 2021. Yukon’s Minister of Community Services, John Streiker, says he’s outraged that a couple from outside the territory travelled to a remote community this week and received doses of COVID-19 vaccine. THE CANADIAN PRESS/Andrew Vaughan-POOL
Couple charged after travelling to Yukon to get COVID-19 vaccine

The maximum fine under the emergency measures act is $500, and up to six months in jail

Metis Nation of B.C. President Clara Morin Dal Col poses in this undated handout photo. The Metis Nation of B.C. says Dal Col has been suspended from her role as president. The Metis Nation of B.C. says Dal Col has been suspended from her role as president. THE CANADIAN PRESS/HO, Metis Nation of B.C. *MANDATORY CREDIT*
Metis Nation of B.C. suspends president, citing ‘breach’ of policies, procedures

Vice-president Lissa Smith is stepping in to fill the position on an acting basis

Prime Minister Justin Trudeau speaks in the in the House of Commons on Parliament Hill in Ottawa on Thursday, Dec. 3, 2020. THE CANADIAN PRESS/Justin Tang
Payette shouldn’t get same benefits as other ex-governors general: O’Toole

Former governors general are entitled to a pension and also get a regular income paid to them for the rest of their lives

Cascade Christian School in Chilliwack will be closed until Feb. 5, 2021 due to a cluster of cases in the school. The school made the decision to close “out of an abundance of caution,” says Fraser Health. (Cascade Christian School image)
COVID-19 cluster leads to closure at Chilliwack Christian school

Cascade Christian School makes decision to close after seven people test positive for COVID-19

Most Read