A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Just Posted

Police officers and their dogs undergo training at the RCMP Police Dog Services training centre in Innisfail, Alta., on Wednesday, July 15, 2015. Mounties say they are searching for an armed and dangerous man near a provincial park in northern Alberta who is believed to have shot and killed a service dog during a police chase. THE CANADIAN PRESS/Jeff McIntosh
RCMP search for armed man in northern Alberta after police dog shot and killed

Cpl. Deanna Fontaine says a police service dog named Jago was shot during the pursuit

Alberta now has 2,336 active cases of COVID-19, with 237 people in hospital, including 58 in intensive care. (Black Press file photo)
Red Deer down to 73 active cases of COVID-19, lowest since early November

The Central zone has 253 active cases of the virus

People line up to get their COVID-19 vaccine at a vaccination centre, Thursday, June 10, 2021 in Montreal. THE CANADIAN PRESS/Ryan Remiorz
Vaccines, low COVID case counts increase Father’s Day hope, but risk is still there

Expert says people will have to do their own risk calculus before popping in on Papa

Canadian Prime Minister Justin Trudeau is seen during a joint news conference following the EU-Canada Summit, in Brussels, Belgium, Tuesday June 15, 2021. Trudeau says Canada is on track now to have 68 million doses delivered by the end of July, which is more than enough to fully vaccinate all 33.2 million Canadians over the age of 12. THE CANADIAN PRESS/Adrian Wyld
Vaccine deliveries enough to fully vaccinate all eligible Canadians by end of July

Three in four eligible Canadians now have their first dose, nearly one in five fully vaccinated.

Chief Public Health Officer Theresa Tam listens to a question during a news conference, in Ottawa, Tuesday, Jan. 12, 2021. The number of confirmed COVID-19 cases attributed to the highly contagious Delta variant grew in Canada this week. THE CANADIAN PRESS/Adrian Wyld
Canada’s public health agency reports spike in confirmed cases of Delta variant

More than 2,000 cases of the variant confirmed across all 10 provinces and in one territory

The federal government says it wants to ban most flavoured vaping products in a bid to reduce their appeal to youth. THE CANADIAN PRESS/AP-Craig Mitchelldyer
Health Canada proposes ban on most vaping flavours it says appeal to youth

If implemented, the regulations would restrict all e-cigarette flavours except tobacco, mint and menthol

The Montreal Police logo is seen in Montreal on Wednesday, July 8, 2020. Some Quebec politicians are calling for an investigation after a video was released that appears to show a Montreal police officer with his leg on a young Black man’s neck during an arrest. THE CANADIAN PRESS/Paul Chiasson
Probe called for after video appearing to show Montreal officer’s knee on Black youth’s neck

Politicians call for investigation after clip evokes memories of George Floyd incident

Thousands of protesters make their way through the downtown core during a Black Lives Matter protest in Ottawa, Friday June 5, 2020. THE CANADIAN PRESS/Adrian Wyld
MPs’ study of systemic racism in policing concludes RCMP needs new model

Chair of the House public safety committee says it’s time for a reckoning on ‘quasi-military’ structure

A case filled with packages of boneless chicken breasts is shown in a grocery store Sunday, May 10, 2020, in southeast Denver. THE CANADIAN PRESS/AP-David Zalubowski
One million chickens euthanized during labour dispute at Quebec slaughterhouse

Premier says waste amounts to 13 per cent of the province’s chicken production thrown in the garbage

A section of the eastern slopes of the Canadian Rockies is seen west of Cochrane, Alta., Thursday, June 17, 2021. A joint federal-provincial review has denied an application for an open-pit coal mine in Alberta’s Rocky Mountains, saying its impacts on the environment and Indigenous rights aren’t worth the economic benefits it would bring. THE CANADIAN PRESS/Jeff McIntosh
Panel says Grassy Mountain coal mine in Alberta Rockies not in public interest

Public hearings on the project in southern Alberta’s Crowsnest Pass region were held last fall

The border crossing into the United States is seen during the COVID-19 pandemic in Lacolle, Que. on Friday, February 12, 2021. THE CANADIAN PRESS/Paul Chiasson
U.S. border restrictions to remain in place until at least July 21

Safety minister says Canada, U.S. extending restrictions on non-essential international travel

Most Read