A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

The Langley School District issues COVID-19 notifications when cases are discovered at local public school. Fraser Health handles contact tracing and all medical aspects for all local schools. (Langley Schools)
Positive COVID test at RE Mountain Secondary

10 schools in the Langley District have had exposures

John Campbell, with the Langley Rotary Club, got to check out the recently installed cold frames with Douglas Park Community School teacher Lorraine Goulet. (John Campbell/Special to the Langley Advance Times)
Rotary donation allows Langley students to get growing

Douglas Park Community School has new cold frames for its courtyard garden

Police blocked off 40th Avenue on Jan. 10, 2015 while firefighters battled a meth lab blaze. The fire has led to a lawsuit against Langley Township. (Langley Advance Times files)
Bill for meth lab fire leads to lawsuit against Langley Township

Local farmers say they shouldn’t have to pay costs of putting out fire in rental house

Wes Barker, second from left, with fellow Big Trick Energy show performers on “Ellen,” in video posted to youtube.com.
VIDEO: On ‘Ellen,’ former Langley man works magic with new ‘Big Trick Energy’ gang

A decade ago, Wes Barker quit his job with the City of Surrey to do magic professionally

Dr. Bonnie Henry gives her daily media briefing regarding Covid-19 for the province of British Columbia in Victoria, B.C, Monday, December 7, 2020.   THE CANADIAN PRESS/Jonathan Hayward
More Langley-area business closed due to COVID-19

Any business with three or more cases among employees can be closed

Rainbow trouts thrashing with life as they’re about to be transferred to the largest lake of their lives, even though it’s pretty small. These rainbows have a blue tinge because they matched the blue of their hatchery pen, but soon they’ll take on the green-browns of their new home at Lookout Lake. (Zoe Ducklow/News Staff)
VIDEO: B.C. lake stocked with hatchery trout to delight of a seniors fishing club

The Cherish Trout Scouts made plans to come back fishing soon

An Extinction Rebellion Vancouver Island (XRVI) climate change event in 2019 saw a large crowd occupy the Johnson Street bridge. Black Press File Photo
‘We walk in grief for our dying world’: B.C. climate activists embark on 4-day protest

The four-day trek on foot and by ferry will see them end at the legislature

Kelly Ng (left) tries to get the attention of Podzol and Aquila as twin sister, Pauline Ng, snaps a photo of the two dogs by a field of hyacinths at the Chilliwack Tulips attraction on April 13. (Jenna Hauck/ Chilliwack Progress)
PHOTOS: Strolling through tulips, hyacinths and daffodils at Chilliwack Tulips attraction

Colourful spring flower attraction now open in Chilliwack, continues into May

A vial of some of the first 500,000 of the two million AstraZeneca COVID-19 vaccine doses that Canada secured. THE CANADIAN PRESS/Carlos Osorio
Canada’s 2nd blood clot confirmed in Alberta after AstraZeneca vaccine

Thw male patient, who is in his 60s, is said to be recovering

Cannabis bought in British Columbia (Ashley Wadhwani/Black Press Media)
Is it time to start thinking about greener ways to package cannabis?

Packaging suppliers are still figuring eco-friendly and affordable packaging options that fit the mandates of Cannabis Regulations

Valen a student of Coldstream Elementary writes advice for adults amid a pandemic.
‘We can get rid of COVID together’: B.C. kids share heartwarming advice

Elementary students share their wisdom to adults in unprecedented times

The funeral of Britain’s Prince Philip in Windsor, England, on Saturday, April 17, 2021. Philip died April 9 at the age of 99. (Kirsty Wigglesworth/AP)
PHOTOS: Prince Philip laid to rest Saturday as sombre queen sits alone

The entire royal procession and funeral took place out of public view within the grounds of Windsor Castle

B.C. Health Minister Adrian Dix and Premier John Horgan describe vaccine rollout at the legislature, March 29, 2021. (B.C. government)
B.C. health minister says delay in Moderna vaccine ‘disappointing’

‘The sooner we get vaccines in people’s arms the better, and inconsistency in delivery is a consistent problem. This is simply a reality and not an issue of blame,’ Adrian Dix said Friday

(Police handout/Kamloops RCMP)
B.C. man dies in custody awaiting trial for Valentine’s Day robbery, kidnapping spree

Robert James Rennie, who was on the Kamloops RCMP’s most wanted list, passed away at the North Fraser Pretrial Centre in Coquitlam

Most Read