A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

The Port of Prince Rupert has experienced another year of increased cargo volumes, shipped through the city, with more than $50 billion in international trade facilitated through the area, the Port Authority announced on Jan. 18. (Photo: K-J Millar/The Northern View)
Port cargo volume growth continues despite pandemic obstacles

Prince Rupert Port authority announces $50 billion in international trade

The IIO B.C. is seeking witnesses to an arrest made in Penticton on Nov. 8, during which the male resisted and sustained a head injury. (File Photo)
The Independent InvestigationsOffice of B.C. released a report on Jan. 18 that a Prince Rupert RCMP officer is cleared of any serious harm wrongdoing from a May 29, 2020 incident. (File Photo)
Police watchdog investigation clears Prince Rupert police officer

IIO investigated May 29 incident where woman fell 25 metres in Prince Rupert

Face masks are required to be worn in all SD 52 common areas such as hallways. School District 52 announced on Jan. 15 three different schools in Prince Rupert all had a member of the school community test positive for COVID-19. (Photo: K-J Millar/The Northern View)
3 Prince Rupert schools have positive COVID-19 case(s)

Letters sent home to families in three Prince Rupert schools announcing COVID-19

Power outages affected thousands of BC Hydro customers in the north on Jan. 14 (File photo) (File photo)
Power outages affect thousands of BC Hydro customers in northern B.C.

Transmission failure led to outages in Prince Rupert and Port Edward

Provincial health officer Dr. Bonnie Henry prepares a daily update on the coronavirus pandemic, April 21, 2020. (B.C. Government)
B.C. adjusts COVID-19 vaccine rollout for delivery slowdown

Daily cases decline over weekend, 31 more deaths

Island Health chief medical officer Dr. Richard Stanwick receives a first dose of Pfizer vaccine, Dec. 22, 2020. (B.C. government)
B.C. turns to second doses of COVID-19 vaccine as supplies slow

Pfizer shipments down until February, to be made up in March

B.C.’s Ministry of Advanced Education and Skills Training announced funding to train community mental health workers at four B.C. post-secondary institutions. (Stock photo)
B.C. funding training of mental health workers at four post-secondary institutions

Provincial government says pandemic has intensified need for mental health supports

A health-care worker prepares a dose of the Pfizer-BioNTech COVID-19 vaccine at a UHN COVID-19 vaccine clinic in Toronto on Thursday, January 7, 2021. THE CANADIAN PRESS/Nathan Denette
No Pfizer vaccines arriving in Canada next week; feds still expect 4M doses by end of March

More cases of U.K. variant, South African variant found in Canada

Health-care workers wait in line at a UHN COVID-19 vaccine clinic in Toronto on Thursday, January 7, 2021. THE CANADIAN PRESS/Nathan Denette
Canadians who have had COVID-19 should still get the vaccine, experts say

Pfizer-BioNTech and Moderna vaccines were found to have a 95 per cent efficacy

An empty Peel and Sainte-Catherine street is shown in Montreal, Saturday, Jan. 9, 2021, as the COVID-19 pandemic continues in Canada and around the world. THE CANADIAN PRESS/Graham Hughes
Poll finds strong support for COVID-19 curfews despite doubts about effectiveness

The poll suggests 59 per cent remain somewhat or very afraid of contracting COVID-19

A female prisoner sent Langford police officers a thank-you card after she spent days in their custody. (Twitter/West Shore RCMP)
Woman gives Victoria-area jail 4.5-star review in handwritten card to police after arrest

‘We don’t often get thank you cards from people who stay with us, but this was sure nice to see’: RCMP

An elk got his antlers caught up in a zip line in Youbou over the weekend. (Conservation Officer Service Photo)
Elk rescued from zip line in Youbou on Vancouver Island

Officials urge people to manage items on their property that can hurt animals

Most Read