A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Just Posted

Police tape is shown in Toronto Tuesday, May 2, 2017. Statistics Canada says the country's crime rate ticked up again in 2018, for a fourth year in a row, though it was still lower than it was a decade ago. THE CANADIAN PRESS/Graeme Roy
CRIME STOPPERS: ‘Most wanted’ for the week of June 20

Crime Stoppers’ weekly list based on information provided by police investigators

New mural at Glenwood Elementary School designed by Jillian Currie. (Special to The News)
Maple Ridge school to unveil new mural

Grizzly bear mural to be unveiled on National Indigenous Peoples Day

Letter writer Sarah Chesterman is urging society to protect nature, noting old growth forests provide homes for animals such as this endangered western screech owl. (Special to The News)
LETTER: Maple Ridge resident urges people to value trees for more than money

Preserving old growth forests are vital to the survival of humans, letter writer says

The vigil will be held on the grounds of Holy Spirit Anglican Church in Whonnock. (Google Maps/Special to The News)
Bells will be tolling in Maple Ridge for victims of former residential school

The bells at Holy Spirit Anglican Church will toll 215 times on Monday, June 21

Share your opinion via email, through our website or in a posted letter. (Heather Colpitts/Black Press Media)
LETTER: Maple Ridge man critical of public’s gullibility

News has become entertainment and public only has itself to blame, letter writer says

Marco Mendicino, Minister of Immigration, Refugees and Citizenship during a press conference in Ottawa on Thursday, May 13, 2021. THE CANADIAN PRESS/Sean Kilpatrick
Canada to welcome 45,000 refugees this year, says immigration minister

Canada plans to increase persons admitted from 23,500 to 45,000 and expedite permanent residency applications

This undated file photo provided by Ernie Carswell & Partners shows the home featured in the opening and closing scenes of The Brady Bunch in Los Angeles. Do you know the occupation of Mike Brady, the father in this show about a blended family? (Anthony Barcelo/Ernie Carswell & Partners via AP, File)
QUIZ: A celebration of dad on Father’s Day

How much do you know about famous fathers?

Emily Steele holds up a collage of her son, 16-year-old Elijah-Iain Beauregard who was stabbed and killed in June 2019, outside of Kelowna Law Courts on June 18. (Aaron Hemens/Capital News)
Kelowna woman who fatally stabbed teen facing up to 1.5 years of jail time

Her jail sentence would be followed by an additional one to 1.5 years of supervision

Cpl. Scott MacLeod and Police Service Dog Jago. Jago was killed in the line of duty on Thursday, June 17. (RCMP)
Abbotsford police, RCMP grieve 4-year-old service dog killed in line of duty

Jago killed by armed suspect during ‘high-risk’ incident in Alberta

Cannabis bought in British Columbia (Ashley Wadhwani/Black Press Media)
Is it time to start thinking about greener ways to package cannabis?

Packaging suppliers are still figuring eco-friendly and affordable packaging options that fit the mandates of Cannabis Regulations

The George Road wildfire near Lytton, B.C., has grown to 250 hectares. (BC Wildfire Service)
B.C. drone sighting halts helicopters fighting 250 hectares of wildfire

‘If a drone collides with firefighting aircraft the consequences could be deadly,’ says BC Wildfire Service

A dose of the Pfizer-BioNTech COVID-19 vaccine is pictured at a vaccination site in Vancouver Thursday, March 11, 2021. THE CANADIAN PRESS/Jonathan Hayward
NACI advice to mix vaccines gets varied reaction from AstraZeneca double-dosers

NACI recommends an mRNA vaccine for all Canadians receiving a second dose of a COVID-19 vaccine

A aerial view shows the debris going into Quesnel Lake caused by a tailings pond breach near the town of Likely, B.C., Tuesday, Aug. 5, 2014. THE CANADIAN PRESS/Jonathan Hayward
Updated tailings code after Mount Polley an improvement: B.C. mines auditor

British Columbia’s chief auditor of mines has found changes to the province’s requirements for tailings storage facilities

A North Vancouver man was arrested Friday and three police officers were injured after a 10-person broke out at English Bay on June 19, 2021. (Youtube/Screen grab)
Man arrested, 3 police injured during 10-person brawl at Vancouver beach

The arrest was captured on video by bystanders, many of whom heckled the officers as they struggled with the handcuffed man

Most Read