A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Just Posted

Two volunteers work to sieve a sample of sand and ocean water through a filter, capturing any potential microplastics. (Courtesy of Ocean Diagnostics)
Victoria startup making waves in microplastics research

New products from Ocean Diagnostics will make research faster, more affordable

Island Savings kick-starts the Equipped to Heal campaign with $120,000. (Courtesy Victoria Hospitals Foundation)
Latest Victoria Hospitals Foundation campaign targets $1M for mental health

Goal is to outfit new 19-bed unit at Eric Martin Pavilion

Willows Beach in Oak Bay. (Black Press Media file photo)
Seven days of sun set to shine on Greater Victoria

Special weather statement warns of higher than usual temperatures

Hot rods, rad rods, muscle and sports cars spanning the decades made their way in a parade from North Saanich to Victoria on June 19. (Kiernan Green/News Staff)
PHOTOS: Classic cars cruise Saanich Peninsula in advance of Father’s Day

Retirement home residents from North Saanich to Victoria treated to a spectacle of hot rides

Chef Trevor Randle leads a June 21 online cooking featuring recipes – beef zesty lettuce wraps, blueberry strudel and blueberry spritzer. (Courtesy We Heart Local BC)
Free online cooking course explores B.C. blueberries and beef

Chef Trevor Randle calls them the province’s most flavourful foods

Jesse Roper tackles weeds in his garden to kick off the 2021 season of What’s In My Garden Man? (YouTube/Whats In My Garden)
VIDEO: Metchosin singer-songwriter Jesse Roper invites gardeners into his plot

What’s In My Garden, Man? kicks off with the poop on compost

FILE – Most lanes remain closed at the Peace Arch border crossing into the U.S. from Canada, where the shared border has been closed for nonessential travel in an effort to prevent the spread of the coronavirus, Thursday, May 7, 2020, in Blaine, Wash. The restrictions at the border took effect March 21, while allowing trade and other travel deemed essential to continue. (AP Photo/Elaine Thompson)
Feds to issue update on border measures for fully vaccinated Canadians, permanent residents

Border with U.S. to remain closed to most until at least July 21

A portion of the George Road wildfire burns near Lytton, B.C. in this Friday, June 18, 2021 handout photo. THE CANADIAN PRESS/HO, BC Wildfire Service *MANDATORY CREDIT*
Blaze near Lytton spread across steep terrain, says BC Wildfire Service

Fire began Wednesday and is suspected to be human-caused, but remains under investigation

Blair Lebsack, owner of RGE RD restaurant, poses for a portrait in the dining room, in Edmonton, Friday, June 18, 2021. Canadian restaurants are having to find ways to deal with the rising cost of food. THE CANADIAN PRESS/Jason Franson
Canadian restaurateurs grapple with rising food costs, menu prices expected to rise

Restaurants are a low margin industry, so there’s not a lot of room to work in additional costs

A Lotto 6/49 ticket purchased in Parksville for the June 19, 2021 draw is a $3M winner. (Submitted photo)
Winning Lotto 6/49 ticket worth $3M purchased on Vancouver Island

Lottery prize winners have 52 weeks to claim jackpot

Cpl. Scott MacLeod and Police Service Dog Jago. Jago was killed in the line of duty on Thursday, June 17. (RCMP)
Abbotsford police, RCMP grieve 4-year-old service dog killed in line of duty

Jago killed by armed suspect during ‘high-risk’ incident in Alberta

The George Road wildfire near Lytton, B.C., has grown to 250 hectares. (BC Wildfire Service)
B.C. drone sighting halts helicopters fighting 250 hectares of wildfire

‘If a drone collides with firefighting aircraft the consequences could be deadly,’ says BC Wildfire Service

Barbara Violo, pharmacist and owner of The Junction Chemist Pharmacy, draws up a dose behind vials of both Pfizer-BioNTech and Oxford-AstraZeneca COVID-19 vaccines on the counter, in Toronto, Friday, June 18, 2021. An independent vaccine tracker website founded by a University of Saskatchewan student says just over 20 per cent of eligible Canadians — those 12 years old and above — are now fully vaccinated. THE CANADIAN PRESS/Nathan Denette
At least 20% of eligible Canadians fully vaccinated, 75% with one dose: data

Earlier projections for reopening at this milestone didn’t include Delta variant

Most Read