A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Just Posted

The City of Vernon is asking the Vernon Elks to come back with more information regarding their request for a financial or in-kind donation. (Google Maps)
Zero funding for Vernon Elks club

Once-in-100-years grant denied after back and forth with city for support

A conceptual design of Vernon’s new Active Living Centre, which will go to referendum Oct. 15, 2022. (Rendering)
Active living centre 2022 referendum planned in Vernon

City hoping to get Coldstream and Areas B and C back on board

Vernon’s historic Towne Cinema, opened at its current 30th Avenue location as a dance hall in 1929 and was converted to a movie theatre in 1938. (GoFundMe photo)
Let the show go on: $100,000 raised for Vernon Towne Cinema

The Okanagan Screen Arts Society plans on reopening of the historic cinema after Labour Day

(City of Vernon)
Flowers and cards are left at a makeshift memorial at a monument outside the former Kamloops Indian Residential School to honour the 215 children whose remains are believed to have been discovered buried near the city in Kamloops, B.C., on Monday, May 31, 2021. THE CANADIAN PRESS/Darryl Dyck
No words to express collective grief: Vernon mayor on 215 buried at residential school

Vernon mayor pens letter to Okanagan Indian Band Chief and council

Singer-songwriter Jann Arden is pictured with a draft horse. (Canadian Horse Defence Coalition)
Jann Arden backs petition to stop live horse export

June 14 is the International Day to End Live Export of Animals

Montreal Canadiens goaltender Carey Price (31) is scored on by Vegas Golden Knights defenseman Alec Martinez, not pictured, during the second period in Game 1 of an NHL hockey Stanley Cup semifinal playoff series Monday, June 14, 2021, in Las Vegas. (AP Photo/John Locher)
Habs fall 4-1 to Vegas Golden Knights in Game 1 of NHL semifinal series

Match was Montreal’s first game outside of Canada in 2021

(Dave Ogilvie photo)
One injured after being pinned by fallen forklift near Peachland

West Kelowna emergency crews responded to reports of a person stuck under a forklift

Penticton Overdose Prevention Society co-founders Desiree Franz, Shane Surowski and Stephanie Lines have created the city’s first unsanctioned public overdose prevention site using an old wine-tour bus. The site began operations in June 2021. (Desiree Franz/Facebook)
Volunteers launch Penticton’s first public supervised injection site

2021 is on pace to be the deadliest year for overdoses in Penticton on record

Kelowna-Lake Country MLA Norm Letnick, assistant deputy speaker at the B.C. legislature, presides over committee discussions. The legislature is completing its delayed spring session this week, with most MLAs participating by video conference. (Hansard TV)
B.C.’s daily COVID-19 infections dip below 100 over weekend

Only 68 new cases recorded Monday, four additional deaths

B.C. ambulance station in Revelstoke is expected to get a new system called the Scheduled On-Call (SOC) this fall. (Liam Harrap - Revelstoke Review)
B.C. ambulance changes could put Revelstoke residents at risk, warn local paramedics

Paramedics said to expect a substantial increase in ambulance response time starting this fall

Mounties cover a burgundy truck with a tent at Buckerfields in West Kelowna on Monday, June 14. The RCMP is investigating after a woman’s body was found inside the truck. (Amandalina Letterio/Capital News)
West Kelowna RCMP investigating suspicious death after body found in truck

Police responded to a truck parked out front of a Main Street business where the body was found

The BC Ferries website went down for a short while Monday morning following a provincial announcement that recreational travel between health authorities can resume Tuesday. (Black Press Media file photo)
BC Ferries’ website crashes in wake of provincial reopening announcement

Website back up now, recreational travel between health regions to resume as of Tuesday

The Kamloops Indian Residential School is photographed using a drone in Kamloops, B.C., Monday, June, 14, 2021. The remains of 215 children were discovered buried near the former school earlier this month. THE CANADIAN PRESS/Jonathan Hayward
Communities grapple with what to do with former residential and day schools

Some tear them down as a tool to help healing, others repurpose them as tools for moving forward

Most Read