A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Just Posted

A tent housing a mobile vaccination clinic. (Interior Health/Contributed)
Over 5K jabbed at Interior Health mobile COVID-19 vaccine clinics

The clinics have made stops in more than 40 communities since launching last week

Provincial Health Officer Dr. Bonnie Henry talks about B.C.’s plan to restart the province during a press conference at Legislature in Victoria, Tuesday, May 25, 2021. THE CANADIAN PRESS/Chad Hipolito
Interior Health COVID-19 cases falling slower than the rest of B.C.

More than a third of provincial cases announced Thursday came from the Interior

A tent housing a mobile vaccination clinic. (Interior Health/Contributed)
Second dose vaccinations accelerating throughout region: Interior Health

To date, more than 675,000 doses have been administered throughout the region

Okanagan Lake (File photo)
Thompson-Okanagan ready to welcome back tourists

The Thompson-Okanagan Tourism Association expects this summer to be a busy one

Aerial view of a wildfire at 16 Mile, 11 kilometres northwest of Cache Creek, that started on the afternoon of June 15. (Photo credit: BC Wildfire Service)
Wildfire at 16 Mile now being held

Wildfire started on the afternoon of June 15 at 16 Mile, east of Highway 97

Marco Mendicino, Minister of Immigration, Refugees and Citizenship during a press conference in Ottawa on Thursday, May 13, 2021. THE CANADIAN PRESS/Sean Kilpatrick
Canada to welcome 45,000 refugees this year, says immigration minister

Canada plans to increase persons admitted from 23,500 to 45,000 and expedite permanent residency applications

Blair Lebsack, owner of RGE RD restaurant, poses for a portrait in the dining room, in Edmonton, Friday, June 18, 2021. Canadian restaurants are having to find ways to deal with the rising cost of food. THE CANADIAN PRESS/Jason Franson
Canadian restaurateurs grapple with rising food costs, menu prices expected to rise

Restaurants are a low margin industry, so there’s not a lot of room to work in additional costs

RCMP crest. (Black Press Media files)
Fort St. John man arrested after allegedly inviting sexual touching from children

Two children reported the incident to a trusted adult right away

Barbara Violo, pharmacist and owner of The Junction Chemist Pharmacy, draws up a dose behind vials of both Pfizer-BioNTech and Oxford-AstraZeneca COVID-19 vaccines on the counter, in Toronto, Friday, June 18, 2021. An independent vaccine tracker website founded by a University of Saskatchewan student says just over 20 per cent of eligible Canadians — those 12 years old and above — are now fully vaccinated. THE CANADIAN PRESS/Nathan Denette
At least 20% of eligible Canadians fully vaccinated, 75% with one dose: data

Earlier projections for reopening at this milestone didn’t include Delta variant

This undated file photo provided by Ernie Carswell & Partners shows the home featured in the opening and closing scenes of The Brady Bunch in Los Angeles. Do you know the occupation of Mike Brady, the father in this show about a blended family? (Anthony Barcelo/Ernie Carswell & Partners via AP, File)
QUIZ: A celebration of dad on Father’s Day

How much do you know about famous fathers?

Emily Steele holds up a collage of her son, 16-year-old Elijah-Iain Beauregard who was stabbed and killed in June 2019, outside of Kelowna Law Courts on June 18. (Aaron Hemens/Capital News)
Kelowna woman who fatally stabbed teen facing up to 1.5 years of jail time

Her jail sentence would be followed by an additional one to 1.5 years of supervision

Cpl. Scott MacLeod and Police Service Dog Jago. Jago was killed in the line of duty on Thursday, June 17. (RCMP)
Abbotsford police, RCMP grieve 4-year-old service dog killed in line of duty

Jago killed by armed suspect during ‘high-risk’ incident in Alberta

The George Road wildfire near Lytton, B.C., has grown to 250 hectares. (BC Wildfire Service)
B.C. drone sighting halts helicopters fighting 250 hectares of wildfire

‘If a drone collides with firefighting aircraft the consequences could be deadly,’ says BC Wildfire Service

A dose of the Pfizer-BioNTech COVID-19 vaccine is pictured at a vaccination site in Vancouver Thursday, March 11, 2021. THE CANADIAN PRESS/Jonathan Hayward
NACI advice to mix vaccines gets varied reaction from AstraZeneca double-dosers

NACI recommends an mRNA vaccine for all Canadians receiving a second dose of a COVID-19 vaccine

Most Read