A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Dallas Lajimodiere is wanted by the Abbotsford Police Department.
Man wanted by Abbotsford Police domestic violence unit

Dallas Lajimodiere has three arrest warrants, including for assault with a weapon

Russell Jonathon George Gurney was last seen in Chilliwack in mid-December. (RCMP photo)
RCMP ask for help to find missing Abbotsford man last seen in Chilliwack

Police and family are concerned for the well-being of Russell Jonathon George Gurney

Grade 6 students at Eugene Reimer Middle School have been participating in the Equity Backpack Project. (Submitted photo)
Equity Backpack Project in Abbotsford addresses inclusion and anti-racism

Grade 6 teacher Nerlap Sidhu says she wants students to develop ‘strong sense of self’

The UFV Cascades women’s basketball program has announced the signing of Langley’s Esther Allison and Edmonton’s Charley Arnold for 2021. (UFV Cascades photo)
Langley’s Allison, Edmonton’s Arnold signed by UFV Cascades

Women’s basketball program adds pair of recruits for 2021, reporting to Abbotsford later this year

Maj.-Gen. Dany Fortin, vice-president of logistics and operations at the Public Health Agency of Canada, speaks at a news conference on the COVID-19 pandemic in Ottawa, on Friday, Jan. 15, 2021. THE CANADIAN PRESS/Justin Tang
B.C. records 500 new COVID-19 cases Wednesday, 14 deaths

Outbreak at Surrey Pretrial jail, two more in health care

A woman writes a message on a memorial mural wall by street artist James “Smokey Devil” Hardy during a memorial to remember victims of illicit drug overdose deaths on International Overdose Awareness Day, in the Downtown Eastside of Vancouver, on Monday, August 31, 2020. THE CANADIAN PRESS/Darryl Dyck
B.C. paramedics respond to record-breaking number of overdose calls in 2020

On the front lines, COVID-19 has not only led to more calls, but increased the complexity

Eighteen-year-old Aidan Webber died in a marine accident in 2019. He was a Canadian Junior BMX champion from Nanaimo. (Submitted)
Inadequate safety training a factor in teen BMX star’s workplace death in 2019

Aidan Webber was crushed by a barge at a fish farm near Port Hardy

Southern resident killer whales in B.C. waters. Research shows the population’s females are more negatively influenced by vessel traffic than males. (Photo supplied by Ocean Wise Conservation Association)
Female orcas less likely to feed in presence of vessel traffic: study

Research the southern resident population raises concerns over reproduction capacity

(Black Press Media files)
Transport Canada not budging on enclosed deck rules, despite calls from BC Ferries union

There have been at least 23 cases of the U.K. variant detected in Canada, four of which are in B.C.

The Elk Valley Hospital is adapting to meet the needs of patients in the Elk Valley.
1-in-5 COVID tests coming back positive in and around Fernie, sparking concern

Dr Ron Clark of Elk Valley Hospital said one in five tests was returning positive for COVID-19

Ralliers gather in front of the Cityviews Village apartment building in Maple Ridge to protest attempts to evict low-income tenants by the building owner. (Ronan O’Doherty - The News)
Tenants protest pressure tactics by new landlord at Maple Ridge apartment building

Protest held in front of Cityviews Village on 223 St. Tuesday to rally against low-income evictions

Cannabis bought in British Columbia (Ashley Wadhwani/Black Press Media)
Is it time to start thinking about greener ways to package cannabis?

Packaging suppliers are still figuring eco-friendly and affordable packaging options that fit the mandates of Cannabis Regulations

Throughout December, RCMP conducted CounterAttack road checks as police worked to keep roads free of impaired drivers. (BLACK PRESS file photo)
‘You can’t make this stuff up’: Stories from the B.C. CounterAttack campaign

Amusing, yes, but a reminder impaired driving affects ability to drive and to make good decisions

Most Read