A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

My FED Farm, created by Food Eco District (FED), is aiming to help people affected by the COVID-19 grow food in their own back yard. The program is in collaboration with Sooke Region Food CHI, Transition Sooke and the Sooke Garden Club. (File - Black Press Media)
Sooke backyard food program returns

The Sooke Backyard Food Program is returning for a second year. Sooke… Continue reading

Father Marinaldo Batista, who served at Catholic parishes in Saanich and Sooke, died April 1 in Brazil from complications of COVID-19. (Facebook/St. Elizabeth Church)
Brazilian priest who served in Saanich and Sooke dies from COVID-19

Father Marinaldo Batista, 53, went to Brazil to visit his parents and died there April 1

Colwood resident Maria Curcic shows off a one-of-a-kind hat that she created. Curcic is one of several artists that took part in the annual Stinking Fish Studio Tour. (Contributed - Maria Curcic)
Curtain closes on Stinking Fish Studio Tour

The Stinking Fish Studio Tour will live on through the lasting legacy… Continue reading

Colwood restaurants can use city property for patios. (Black Press Media file photo)
Temporary patios back on for Colwood restaurants

Council voted to extend temporary permits to 2022

A photograph of the real firearm beside the replica firearm seized by VicPD in the early hours of April 18. (Courtesy VicPD)
Police seize loaded firearm, drugs during traffic stop in Victoria

Officers find cocaine, methamphetamine and fentanyl along with loaded handgun

In this image from NASA, NASA’s experimental Mars helicopter Ingenuity lands on the surface of Mars Monday, April 19, 2021. The little 4-pound helicopter rose from the dusty red surface into the thin Martian air Monday, achieving the first powered, controlled flight on another planet. (NASA via AP)
VIDEO: NASA’s Mars helicopter takes flight, 1st for another planet

The $85 million helicopter demo was considered high risk, yet high reward

Families of two of three workers killed in a train derailment near Field, B.C., in 2019 have filed lawsuits accusing Canadian Pacific of gross negligence. The derailment sent 99 grain cars and two locomotives off the tracks. THE CANADIAN PRESS/Jeff McIntosh
Families of workers killed in Field train derailment allege negligence in lawsuit

Lawsuits allege the workers weren’t provided a safe work environment

(New Westminster Police)
4 youth arrested after 30-person brawl in New Westminster leaves 1 seriously injured

Police are looking for witnesses who saw the incident take place

South Surrey’s Paul Cottrell, who works with the DFO, tows a grey whale out of Semiahmoo Bay Sunday. (Contributed photo)
Dead whale floating near White Rock towed to shore for necropsy

Animal has been dead since at least April 15

Wickaninnish (Clifford Atleo) plays the drum while singing the Nuu-chah-nulth song on the court steps in Vancouver In a picture from April 2018. Photo credit, Melody Charlie.
Five western Vancouver Island First Nations celebrate legal fishing victory

Court ruling confirms Nuu-chah-nulth fishing rights in case dating back to 2003

Sunday’s storm rocked one of the ferries crossing Kootenay Lake. Photo: Dirk Jonker
VIDEO: Storm makes for wild ferry ride across Kootenay Lake

The video was captured by ferry employee Dirk Jonker

Dr. Bonnie Henry gives her daily media briefing regarding Covid-19 for the province of British Columbia in Victoria, B.C, Monday, December 7, 2020. THE CANADIAN PRESS/Jonathan Hayward
Toddler marks youngest British Columbian to die related to COVID-19

Child one of eight people to die from virus this weekend

Chakalaka Bar & Grill remains open in defiance of orders from Island Health to close. (Cole Schisler photo)
Island Health seeks injunction against restaurant defying COVID-19 orders

VIHA says Ladysmith-area Chakalaka Bar and Grill also violating water and sewer regulations

Pharmacist Barbara Violo arranges all the empty vials of the Oxford-AstraZeneca COVID-19 vaccines that she has provided to customers at the Junction Chemist which is a independent pharmacy during the COVID-19 pandemic in Toronto, on Monday, April 19, 2021. THE CANADIAN PRESS/Nathan Denette
B.C. to open up AstraZeneca vaccines for all people 40+, set up clinics in hot spots

A total of 13 neighbourhoods and communities will receive the AstraZeneca vaccine

Most Read