A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Surrey native Dylan Kinley, shown here with the Douglas College Royals, has signed with the UFV Cascades. (Douglas Royals photo)
UFV Cascades sign Surrey native Dylan Kinley

Tweedsmuir grad, Douglas Royals star joins Abbotsford-based team for 2021-22

Surrey City Hall. (File photo)
OUR VIEW: Surrey’s public hearings are for being heard

Surrey public hearings of late have been devolving into something less than intended

Surrey-raised actor Michael Coleman in some of the roles he’s played since the mid-1990s. (submitted photo)
Chat with Robin Williams helped send Surrey’s Coleman into world of acting

‘For me, it was a game-changer,’ says co-founder of Story Institute acting school

Friends and family of Paul Prestbakmo (from left: Barbara Calder, Leah Charles, Jimmy Slater, Angela Prestbakmo and Liz Prestbakmo) gather outside Surrey Provincial Court on Tuesday (Jan. 26, 2021). (Tracy Holmes photo)
South Surrey murder victim stabbed 42 times: pathologist

RCMP digital-evidence specialist also among witnesses

Record-setting high jumper Emma de Boer, who lives in Cloverdale and attends Holy Cross Regional High School in Fleetwood, will train and study architecture at the University of Pennsylvania (UPenn) next fall. (submitted photo)
Surrey jumper on a high after recruitment by UPenn track team

High jumper Emma de Boer aims to leave Cloverdale for Philadelphia next fall

Dr. Penny Ballem, a former deputy health minister, discusses her role in leading B.C.’s COVID-19 vaccination program, at the B.C. legislature, Jan. 22, 2021. (B.C. government)
B.C. holds steady with 407 new COVID-19 cases Tuesday

14 deaths, no new outbreaks in the health care system

SAR crews worked late into the night Tuesday to rescue an injured snowboarder in North Vancouver. (Facebook/North Shore Rescue)
Complicated, dangerous rescue saves man in avalanche near Cypress Mountain

North Shore SAR team braves considerable conditions to reach injured snowboarder

A Cessna 170 airplane similar to the one pictured above is reported to be missing off the waters between Victoria and Washington State. Twitter photo/USCG
UPDATE: No sign of small plane that went down in waters south of Vancouver Island

Searchers out on both sides of border between Victoria and Port Angeles

Cannabis bought in British Columbia (Ashley Wadhwani/Black Press Media)
Is it time to start thinking about greener ways to package cannabis?

Packaging suppliers are still figuring eco-friendly and affordable packaging options that fit the mandates of Cannabis Regulations

In this undated image made from a video taken by the Duke of Sussex and posted on @SaveChildrenUK by the Duke of Sussex and Meghan, Duchess of Sussex, shows the Duchess of Sussex reading the book “Duck! Rabbit!” to their son Archie who celebrates his first birthday on Wednesday May 6, 2020. The Canadian Paediatric Society is reminding families that the process of raising a reader starts from birth. (Duke of Sussex/@SaveChildrenUK)
Canadian Paediatric Society says raising a reader starts from birth

CPS says literacy is one of the strongest predictors of lifelong health outcomes

Employment, Workforce Development and Disability Inclusion Minister Carla Qualtrough responds to a question during a news conference Thursday August 20, 2020 in Ottawa. THE CANADIAN PRESS/Adrian Wyld
Easing rules for parental benefits created inequities among parents, documents say

Employment Minister Carla Qualtrough’s office says the government will make any necessary changes

People walk along a pedestrianized zone of Sainte-Catherine street in Montreal, Monday, May 18, 2020, as the COVID-19 pandemic continues in Canada and around the world. Newly released statistics point to a major drop in police-recorded crime during the first eight months of the COVID-19 pandemic. THE CANADIAN PRESS/Graham Hughes
Crime down in first 8 months of pandemic, but mental health calls rise: StatCan

The agency says violent crimes such as assault dropped significantly

Cowichan Tribes chief Squtxulenhuw (William Seymour) confirmed the first death in the First Nations community from COVID-19. (File photo)
Cowichan Tribes confirms 1st death amid growing COVID-19 outbreak

Shelter-in-place order has been extended to Feb. 5

(Pixabay)
B.C. teacher gets 1 day suspension after ‘aggressively’ throwing dumbbell at student

Documents show the weight would have hit the student if they didn’t catch it

Most Read