A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Just Posted

Processed sewage is still being deposited at the Hartland landfill rather than sent as biosolids to a Richmond cement plant. (Black Press Media file photo)
Biosolids at Hartland still being placed on landfill in Saanich

Richmond cement plant up and running, but CRD end product not suitable for purpose

Seismic upgrading and expansion work at Victoria High School is about a year behind due to pandemic-related factors, the Greater Victoria School District announced. (Photo by Cole Descoteau)
Victoria High School seismic work, expansion a year behind schedule

Greater Victoria School District now targeting September 2023 for reopening of historic school

Elk Lake Drive area resident Michael Blayney protests a proposed multi-building development for his Royal Oak neighbourhood, outside Saanich municipal hall on Monday (June 14). (Photo by Megan Atkins-Baker/News Staff)
Demonstrators protest 11-storey development on Elk Lake Drive in Saanich

Saanich locals gather at municipal hall to protest development, public hearing goes Tuesday

The Greater Victoria Harbour Authority is calling on Transport Canada to rescind its ban to Feb. 28, 2022 on cruise ship stops in Canada, to allow planning to begin in advance of a reopening of the cruise industry next year.
Greater Victoria Harbour Authority seeks end to federal ban on cruise ship stops in Canada

Greater Victoria Harbour Authority CEO hopes cruises will resume by 2022

(Black Press Media file photo)
Copper piping missing, as suspect found with tools in Oak Bay commercial block

Police briefs include missing dinghy, speed stop turned impaired, wallet swiped from unlocked car

Canadian Prime Minister Justin Trudeau participates in a plenary session at the G7 Summit in Carbis Bay, England on Friday June 11, 2021. THE CANADIAN PRESS/Adrian Wyld
Canada donating 13M surplus COVID-19 vaccine doses to poor countries

Trudeau says the government will pay for 87 million shots to be distributed to poor countries

Kelowna-Lake Country MLA Norm Letnick, assistant deputy speaker at the B.C. legislature, presides over committee discussions. The legislature is completing its delayed spring session this week, with most MLAs participating by video conference. (Hansard TV)
B.C.’s daily COVID-19 infections dip below 100 over weekend

Only 68 new cases recorded Monday, four additional deaths

Neighbours fight a small late-night bush fire with garden hoses and shovels in Cinnabar Valley on June 5. They couldn’t get help from local fire services because the fire was located in an area under B.C. Wildfire Services jurisdiction. (Photo courtesy Muriel Wells)
Neighbours on edge of Nanaimo city limits left to put out bush fire themselves

Cinnabar Valley residents tackle fire with hoses and buckets for two and a half hours

Darren Campbell’s truck (pictured) was stolen when he stopped to check on a car in a ditch on Cowichan Bay Road on Monday morning. (Facebook photo)
Vancouver Island Good Samaritan’s truck stolen in nasty trick

‘Try to be a Good Samaritan and my $20,000 truck gets stolen right under my nose’

The Kamloops Indian Residential School is photographed using a drone in Kamloops, B.C., Monday, June, 14, 2021. The remains of 215 children were discovered buried near the former school earlier this month. THE CANADIAN PRESS/Jonathan Hayward
Communities grapple with what to do with former residential and day schools

Some tear them down as a tool to help healing, others repurpose them as tools for moving forward

Creative handmade signs abound at the June 13 Tofino rally for old growth trees. (Nora O’Malley photo)
VIDEO: Tofino stands in solidarity for Fairy Creek Blockades

Over 150 supporters attend rally hosted by Friends of Clayoquot Sound

FILE – Provincial health officer Dr. Bonnie Henry talks about B.C.’s plan to restart the province during a press conference at Legislature in Victoria, Tuesday, May 25, 2021. THE CANADIAN PRESS/Chad Hipolito
B.C. watching U.K.’s COVID struggles but don’t think province will see similar pitfalls

Studies show that one dose of vaccine is only 33 per cent effective in preventing B.1.617.2 spread

RCMP Const. Shelby Patton is shown in this undated handout photo. RCMP say that Patton was hit by an allegedly stolen truck that he had pulled over on Saturday morning in Wolseley, east of Regina. THE CANADIAN PRESS/HO, RCMP
Pair charged in Saskatchewan Mountie’s death make first court appearance

Const. Shelby Patton was hit by an allegedly stolen truck that he had pulled over Saturday morning

David and Collet Stephan leave for a break during an appeal hearing in Calgary on Thursday, March 9, 2017. THE CANADIAN PRESS/Todd Korol
Appeal Court rejects stay for Alberta couple facing third trial in son’s death

Pair accused in their earlier trials of not seeking medical attention for their son sooner

Most Read