A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Alberta Health reported two new COVID-19 deaths in Red Deer Friday. (Image courtesy CDC)
Two more deaths linked to Olymel outbreak in Red Deer

Province reported 356 additional COVID-19 cases Friday

Alberta Premier Jason Kenney speaks during a news conference in Edmonton on Feb. 24, 2020. It’s budget day in the province, and Kenney’s United Conservative government is promising more help in the fight against COVID, but more red ink on the bottom line. THE CANADIAN PRESS/Jason Franson
Alberta’s budget promises more help for COVID-19 with a hard deficit

Annual spending on debt interest is closing in on $3 billion

The Town of Sylvan Lake has launched a new contest to attract a new business. (File photo by Advocate staff)
Sylvan Lake offering rent-free storefront space to lure new businesses

Winning business proposal will get a storefront space rent-free for a year

Alberta reported an additional 399 cases of COVID-19 Thursday, on 9,217 tests, for a test positivity rate of 4.3 per cent. (Image courtesy CDC)
Red Deer down to 562 active COVID-19 cases

8 new COVID-19 deaths, 399 additional COVID-19 cases

Mike Ammeter (Photo by Rebecca Hadfield)
Sylvan Lake man elected chair of Canadian Canola Growers Association

Mike Ammeter is a local farmer located near the Town of Sylvan Lake

Bookings for COVID-19 vaccines for people age 75 or older start Wednesday. (File photo by THE CANADIAN PRESS)
Updated: Delays for seniors booking for vaccine appointments

By 9:20 a.m. Wednesday, 4,500 seniors had booked their appointments

A helicopter flies past a mountain near McBride, B.C., on Saturday January 30, 2016. THE CANADIAN PRESS/Darryl Dyck
Avalanche warning for backcountry users in North and South Rockies

Avalanche Canada is urging backcountry users to always check their regional avalanche forecasts

Supporters pray outside court in Stony Plain, Alta., on Wednesday, Feb. 24, 2021, as a trial date was set for Pastor James Coates of GraceLife Church. He is charged with holding Sunday services in violation of Alberta’s COVID-19 rules and with breaking conditions of his bail release. THE CANADIAN PRESS/Jason Franson
Trial date for jailed Alberta pastor charged with breaking COVID-19 health orders

The court says it will reconvene with lawyers on March 5 for a case management plan by teleconference

A pharmacist prepares a COVID-19 vaccine at Village Green Retirement Campus in Federal Way on Jan. 26. (Olivia Sullivan/Sound Publishing)
Canada approves use of AstraZeneca’s COVID-19 vaccine

The country joins more than a dozen others in giving the shot the green light

Emily Keeping of Wetaskiwin, Alta., was last seen at 4:20 p.m. on Feb. 25, 2021 at the FasGas on 49 St and 50 Ave in Wetaskiwin. Supplied/ Wetaskiwin RCMP.
UPDATE: Wetaskiwin RCMP seek assistance in locating missing 11-year-old

Emily Keeping was last seen on Feb. 25, 2021 at the FasGas on 49 St and 50 Ave in Wetaskiwin.

Alberta premier Jason Kenney, right and Doug Schweitzer, Minister of Justice and Solicitor General, provide details about Bill 13, the Alberta Senate Election Act., in Edmonton Alta, on Wednesday June 26, 2019. THE CANADIAN PRESS/Jason Franson
Minister Doug Schweitzer talks on Enhanced COVID-19 Business Benefit

Provincial government rolling out new benefit this April to better help small businesses.

NDP leader Jagmeet Singh holds a press conference on Parliament Hill in Ottawa on Wednesday, Feb. 24, 2021. THE CANADIAN PRESS/Sean Kilpatrick
NDP will not trigger election as long as pandemic continues: Singh

‘“We will vote to keep the government going’

Minister Rick Wilson poses with Katie at the Boys and Girls Club of Wetaskiwin, both wearing her Pink Shirt Day design. Facebook/ Boys and Girls Club of Wetaskiwin.
Wetaskiwin Boys and Girls club Pink Shirt day design focuses on kindness

Katie with the Boys and Girls Club of Wetaskiwin created this year’s Pink Shirt Day design.

Most Read