A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

(File photo)
PQB crime report: Vandals strike in Parksville, prowler lurks in Nanoose Bay

Oceanside RCMP receive 276 complaints in one-week period

The intersection of Despard Avenue and Moilliet Street, where a child was struck and injured in November 2020. (Mandy Moraes photo)
High-traffic Parksville intersection to get temporary 4-way stop

City staff to monitor effectiveness of traffic-calming measure at Despard and Moilliet

Vancouver resident Beryl Pye was witness to a “concerning,” spontaneous dance party that spread throughout social groups at Kitsilano Beach on April 16. (Screen grab/Beryl Pye)
VIDEO: Dance party erupts at Vancouver’s Kitsilano Beach to the dismay of onlookers

‘It was a complete disregard for current COVID-19 public health orders,’ says Vancouver resident Beryl Pye

Deputy Prime Minister and Minister of Finance Chrystia Freeland responds to a question during Question Period in the House of Commons Tuesday December 8, 2020 in Ottawa. The stage is set for arguably the most important federal budget in recent memory, as the Liberal government prepares to unveil its plan for Canada’s post-pandemic recovery even as a third wave of COVID-19 rages across the country. THE CANADIAN PRESS/Adrian Wyld
Election reticence expected to temper political battle over federal budget

Opposition parties have laid out their own demands in the weeks leading up to the budget

A syringe is loaded with COVID-19 vaccine at a vaccination clinic run by Vancouver Coastal Health, in Richmond, B.C., Saturday, April 10, 2021. THE CANADIAN PRESS/Jonathan Hayward
B.C. to open up COVID vaccine registration to all B.C. residents 18+ in April

Registration does not equate to being able to book an appointment

(Black Press file photo).
UPDATED: Multiple stabbings at Vancouver Island bush party

Three youths hospitalized after an assault in Comox

Selina Robinson is shown in Coquitlam, B.C., on Friday November 17, 2017. British Columbia’s finance minister says her professional training as a family therapist helped her develop the New Democrat government’s first budget during the COVID-19 pandemic, which she will table Tuesday. THE CANADIAN PRESS/Darryl Dyck
B.C. finance minister to table historic pandemic-challenged deficit budget

Budget aims to take care of people during pandemic while preparing for post-COVID-19 recovery, Robinson said

Each spring, the Okanagan Fest-of-Ale is held in Penticton. This year, as a result of the COVID-19 pandemic, the festival will not be held. However, beer is still available. How much do you know about this beverage? (pxfuel.com)
QUIZ: How much do you really know about beer?

Put your knowledge to the test with this short quiz

Pat Kauwell, a semi-retired construction manager, lives in his fifth-wheel trailer on Maxey Road because that’s what he can afford on his pension, but a Regional District of Nanaimo bylaw prohibits using RVs as permanent dwellings, leaving Kauwell and others like him with few affordable housing options. (Chris Bush/News Bulletin)
Housing crunch or not, it’s illegal to live in an RV in Nanaimo

Regional District of Nanaimo bylaw forcing pensioner to move RV he calls home off private farm land

Lord Tweedsmuir’s Tremmel States-Jones jumps a player and the goal line to score a touchdown against the Kelowna Owls in 2019. The face of high school football, along with a majority of other high school sports, could significantly change if a new governance proposal is passed at the B.C. School Sports AGM May 1. (Malin Jordan)
Power struggle: New governance model proposed for B.C. high school sports

Most commissions are against the new model, but B.C. School Sports (BCSS) and its board is in favour

The B.C. Centre for Disease Control has listed Harbour Air and Air Canada flights to and from Nanaimo, from April 3, 4 and 12, on its list of flights with COVID-19. (News Bulletin file)
COVID-19 cases reported for Nanaimo flights, says disease control centre

Nanaimo flights for April 3, 4 and 12 listed on BCCDC’s list of flights with COVID-19

Most Read