A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Dyllan Petrin is charged related to an ongoing investigation in Surrey involving a kidnapping and assault that occurred in July, 2019. (Photo: Surrey RCMP)
Man arrested in connection to kidnapping, murder investigations: Surrey RCMP

Police say Dyllan Petrin was arrested in Vancouver

Chief Constable Norm Lipinski, Surrey Police Service. (Submitted photo)
Surrey chief constable says ‘comprehensive’ public engagement to be done this year

Norm Lipinski says Surrey Police Service has ‘good momentum’

Surrey-raised forward Jujhar Khaira in action with Edmonton Oilers. (Photo: nhl.com)
Q&A: Surrey’s Jujhar Khaira credits parents for their hard work on his path to NHL

Port Kells-raised player talks about his journey to pro hockey with Edmonton Oilers

The interventional oncology team at Surrey Memorial Hospital. The Surrey Hospitals Foundation has invested in innovative technologies to kickstart a new Interventional Oncology service at Surrey Memorial Hospital. (Submitted photo: Yvonne Chiang)
Surrey Memorial home to machines for ‘minimally invasive’ cancerous tumours treatments

Technology can freeze, burn tumours without need for surgery

Maj.-Gen. Dany Fortin, vice-president of logistics and operations at the Public Health Agency of Canada, speaks at a news conference on the COVID-19 pandemic in Ottawa, on Friday, Jan. 15, 2021. THE CANADIAN PRESS/Justin Tang
B.C. records 500 new COVID-19 cases Wednesday, 14 deaths

Outbreak at Surrey Pretrial jail, two more in health care

A woman writes a message on a memorial mural wall by street artist James “Smokey Devil” Hardy during a memorial to remember victims of illicit drug overdose deaths on International Overdose Awareness Day, in the Downtown Eastside of Vancouver, on Monday, August 31, 2020. THE CANADIAN PRESS/Darryl Dyck
B.C. paramedics respond to record-breaking number of overdose calls in 2020

On the front lines, COVID-19 has not only led to more calls, but increased the complexity

Eighteen-year-old Aidan Webber died in a marine accident in 2019. He was a Canadian Junior BMX champion from Nanaimo. (Submitted)
Inadequate safety training a factor in teen BMX star’s workplace death in 2019

Aidan Webber was crushed by a barge at a fish farm near Port Hardy

Southern resident killer whales in B.C. waters. Research shows the population’s females are more negatively influenced by vessel traffic than males. (Photo supplied by Ocean Wise Conservation Association)
Female orcas less likely to feed in presence of vessel traffic: study

Research the southern resident population raises concerns over reproduction capacity

(Black Press Media files)
Transport Canada not budging on enclosed deck rules, despite calls from BC Ferries union

There have been at least 23 cases of the U.K. variant detected in Canada, four of which are in B.C.

The Elk Valley Hospital is adapting to meet the needs of patients in the Elk Valley.
1-in-5 COVID tests coming back positive in and around Fernie, sparking concern

Dr Ron Clark of Elk Valley Hospital said one in five tests was returning positive for COVID-19

Ralliers gather in front of the Cityviews Village apartment building in Maple Ridge to protest attempts to evict low-income tenants by the building owner. (Ronan O’Doherty - The News)
Tenants protest pressure tactics by new landlord at Maple Ridge apartment building

Protest held in front of Cityviews Village on 223 St. Tuesday to rally against low-income evictions

Throughout December, RCMP conducted CounterAttack road checks as police worked to keep roads free of impaired drivers. (BLACK PRESS file photo)
‘You can’t make this stuff up’: Stories from the B.C. CounterAttack campaign

Amusing, yes, but a reminder impaired driving affects ability to drive and to make good decisions

Snow is forecasted to appear in parts of Metro Vancouver this weekend. (Black Press Media files)
Snow forecasted for parts of Lower Mainland this weekend

Environment Canada is predicting flurries and snow from Saturday to Monday evening

Most Read