A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Tla-o-qui-aht First Nation elected chief councillor Moses Martin, who was also Chantel Moore’s grandfather, speaks to media in Port Alberni on Aug. 16, 2020, during a visit from NDP leader Jagmeet Singh following the police shooting of Chantel Moore. (Elena Rardon photo)
Tla-o-qui-aht First Nation Chief says community “devastated” by third police shooting

Woman shot by Ucluelet RCMP in the Ucluelet First Nation community of Hitacu on May 8.

Tofino is adding to its planning department to keep up with rising interest in residential development in town. (Westerly file photo)
Interest in residential development rising in Tofino

District of Tofino boosting planning department.

The Independent Investigations Office of B.C. is investigating the shooting of an Indigenous woman in the Ucluelet First Nation community of Hitacu. (Black Press Media file photo)
NTC president calls for ‘massive change’ after Indigenous woman shot by police in Hitacu

“We need to get to the root of what is actually happening with the RCMP and our communities”

Hotel Zed Tofino has won a Vancouver Island Real Estate Board Commercial Building Award. (Westerly file photo)
Hotel Zed Tofino wins commercial building award

Vancouver Island Real Estate Board holds virtual gala.

A bullet hole is seen in the windshield of an RCMP vehicle approximately 4 km from Vancouver International Airport after a one person was killed during a shooting outside the international departures terminal at the airport, in Richmond, B.C., Sunday, May 9, 2021. THE CANADIAN PRESS/Darryl Dyck
Homicide team IDs man in fatal YVR shooting as police grapple with spate of gang violence

Man, 20, charged in separate fatal shooting Burnaby over the weekend

Keith MacIntyre - BC Libertarian
Penticton’s Keith MacIntyre new leader of the B.C. Libertarian Party

The Penticton businessman was voted in by members of the party on May 8

RCMP are searching for Philip Toner, who is a 'person of interest' in the investigation of a suspicious death in Kootenay National Park last week. Photo courtesy BC RCMP.
Man sought in suspicious Kootenay death found in Lake Country

Philip Toner is a person of interest in the death of Brenda Ware

Vernon North Okanagan RCMP reported to 287 mental health calls between Jan. 1, 2021, and May 1. (Black Press files)
‘It’s not the police’s responsibility to deal with mental health calls’: Vernon RCMP

RCMP remind public to take care of mental health and well-being, while better solutions are sought

Thompson Rivers University campus is in Kamloops, B.C. (KTW file photo)
Thompson Rivers the 1st B.C. university to supply free menstrual products

The university will offer the products this September

Fraser Health is using ‘targeted’ vaccination clinics in high-risk areas of the Lower Mainland. (Fraser Health photo)
B.C.’s COVID-19 decrease continues, 515 new cases Tuesday

426 seriously ill people in hospital, up from 415 Monday

A scene from the Schoolhouse Squat from October 2018, where Alliance Against Displacement members and supporters occupied the Rutherford Elementary School site, advocating for people experiencing homelessness. (News Bulletin file)
‘Schoolhouse Squat’ activists get conditional discharge in Nanaimo school occupation

Ivan Donald Drury, Tingchun (Listen) Chen sentenced in provincial court in Nanaimo

The site of Sunfest, Laketown Ranch, will be open for camping this summer. (Citizen file)
Sunfest country music bash won’t be shining on B.C. in 2021

Annual Vancouver Island Festival cancelled due to COVID-19, along with Laketown Shakedown

B.C. Agriculture Minister Lana Popham promotes the government’s BuyBC food program in 2019. (B.C. government)
Money running out for fresh fruit, vegetables, milk in B.C. schools

‘Looking at ways to support this type of program,’ minister says

Most Read