A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Ron Sivorot, business director at Kennametal’s Langford site, the Greater Victoria facility that made a component being used on NASA’s Perseverance rover on Mars. (Jake Romphf, Black Press Media)
NASA’s Perseverance Mars rover using piece made at Kennametal’s Langford site

The Greater Victoria plant’s tooth blank is helping the rover’s drill collect rock cores

A provincially appointed consultant has recommended a change to the funding formula for the VicPD that will save Esquimalt a significant amount of money. (Black Press Media file photo)
Esquimalt to save a bundle on policing costs under new formula

Provincial consultant studied funding model, resource deployment for VicPD

A rockfall closed Finlayson Arm Road and West Shore Parkway on Friday (March 5) afternoon. (Twitter/BC Transportation)
UPDATED: Malahat reopens following rockfall

Section of Trans-Canada Highway was scheduled for intermittent closures today for rock scaling work

A Victoria resident was scammed out of $1,700 after a fraudster impersonated a police officer and convinced the victim to pay a non-existent fine in Bitcoin. (Unsplash)
Fraudster impersonates Victoria police officer, steals $1,700 in Bitcoin

Phone call showed up as VicPD’s non-emergency line

The Tsartlip First Nation was outraged after Green MLA Adam Olsen revealed on social media that the community had been experiencing a COVID-19 outbreak – a fact the First Nation had chosen to keep private to avoid racist backlash as experienced by the Cowichan Tribes when an outbreak was declared there in January. (Black Press Media file photo)
Tsartlip First Nation ‘outraged’ after Green MLA revealed COVID-19 outbreak

Chief shares concerns about racist backlash, MLA Adam Olsen apologizes

Provincial health officer Dr. Bonnie Henry updates B.C. on the COVID-19 situation. (B.C. government)
Dr. Bonnie Henry predicts a ‘post-pandemic world’ for B.C. this summer

‘Extending this second dose provides very high real-world protection to more people, sooner’

Malawian police guard AstraZeneca COVID-19 vaccines after the shipment arrived in Lilongwe, Malawi, Friday March 5, 2021. Canada is expecting its first shipments of AstraZeneca vaccine next week. (Associated Press/Thoko Chikondi)
B.C.’s daily COVID-19 cases climb to 634 Friday, four more deaths

Currently 255 people in hospital, 66 in intensive care

A crashed helicopter is seen near Mt. Gardner on Bowen Island on Friday March 5, 2021. Two people were taken to hospital in serious but stable condition after the crash. (Irene Paulus/contributed)
2 people in serious condition after helicopter goes down on Bowen Island

Unclear how many passengers aboard and unclear where the helicopter was going

Surrey Pretrial in Newton. (Photo: Tom Zytaruk)
B.C. transgender inmate to get human rights hearing after being held in mostly male jail

B.C. Human Rights Tribunal member Amber Prince on March 3 dismissed the pretrial’s application to have Makayla Sandve’s complaint dismissed

Supporters rally outside court as Pastor James Coates of GraceLife Church is in court to appeal bail conditions, after he was arrested for holding day services in violation of COVID-19 rules, in Edmonton, Alta., on Thursday March 4, 2021. THE CANADIAN PRESS/Jason Franson
‘Law remains valid:’ Pastor accused of violating health orders to remain in jail

The Justice Centre for Constitutional Freedoms is representing the pastor

The Netflix logo on an iPhone. B.C. delayed imposing sales tax on digital services and sweetened carbonated beverages as part of its response to COVID-19. Those taxes take effect April 1, 2021. THE CANADIAN PRESS/AP, Matt Rourke
B.C. applies 7% sales tax on streaming, vaping, sweet drinks April 1

Measures from 2020 budget were delayed due to COVID-19

A lawyer wears a face mask and gloves to curb the spread of COVID-19 while waiting to enter B.C. Supreme Court, in Vancouver, B.C., Friday, Aug. 28, 2020. British Columbia’s highest court has sided with the land owner in a dispute over public access to public land. THE CANADIAN PRESS/Darryl Dyck
B.C. high court finds in favour of large landowner in fight over access to pair of lakes

The Nicola Valley Fish and Game Club launched legal action after the cattle company blocked road and trail access

Prime Minister Justin Trudeau holds a press conference in Ottawa Friday, March 5, 2021. THE CANADIAN PRESS/Sean Kilpatrick
Trudeau holds firm on premiers’ health-care funding demands, COVID-19 aid comes first

Premiers argue that the current amount doesn’t keep pace with yearly cost increases of about five per cent

Free Reformed Church is seen as people attend service, in Chilliwack, B.C., on Sunday, Feb. 21, 2021. Lawyers for the British Columbia government and the Justice Centre for Constitutional Freedoms are back in B.C. Supreme Court today, squaring off over the legality of COVID-19 rules that prohibit in-person religious services. THE CANADIAN PRESS/Darryl Dyck
B.C. top doctor has power to restrict access to a place during health hazard: lawyer

Under B.C.’s Public Health Act, Jacqueline Hughes says, Henry can restrict or prevent entry to a place

Most Read