A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Just Posted

Hot rods, rad rods, muscle and sports cars spanning the decades made their way in a parade from North Saanich to Victoria on June 19. (Kiernan Green/News Staff)
PHOTOS: Classic cars cruise Saanich Peninsula in advance of Father’s Day

Retirement home residents from North Saanich to Victoria treated to a spectacle of hot rides

A bathtub kitchen garden is part of the lineup for this year’s Teeny Tiny Garden Tour to benefit Victoria Hospice. (Screenshot/Teeny Tiny Garden Tour)
Virtual garden tour for Victoria Hospice features trio of back yards

Online tour is free; calendar purchase and donation options raise money for the cause

Al Kohut, owner of the new photographers GALLERY, checks out Looking Back by David Bradt. The photo printed on canvas is among 50 images featured in the Birds on the Wild Side exhibition showing until July 3. (Wolf Depner/News Staff)
Photo gallery in Sidney plucks out top bird photos

Birds on the Wild Side show running at the new photographers GALLERY until July 3

The Town of Sidney supports efforts to rename Reay Creek to KELSET, its traditional SENCOTEN name. (Black Press Media file photo)
Town of Sidney signs off on Reay Creek name change to KELSET

Name change does not affect surrounding parkland, but public supports doing so

Steve Mann and Tim Hackett consider Marigold Lands their finest development. (Rendering courtesy Marigold Lands)
Marigold residences grow more townhouses and condos in Central Saanich

50 condos, 14 townhouses up next for project adjacent to Pat Bay Highway

Jesse Roper tackles weeds in his garden to kick off the 2021 season of What’s In My Garden Man? (YouTube/Whats In My Garden)
VIDEO: Metchosin singer-songwriter Jesse Roper invites gardeners into his plot

What’s In My Garden, Man? kicks off with the poop on compost

Barbara Violo, pharmacist and owner of The Junction Chemist Pharmacy, draws up a dose behind vials of both Pfizer-BioNTech and Oxford-AstraZeneca COVID-19 vaccines on the counter, in Toronto, Friday, June 18, 2021. An independent vaccine tracker website founded by a University of Saskatchewan student says just over 20 per cent of eligible Canadians — those 12 years old and above — are now fully vaccinated. THE CANADIAN PRESS/Nathan Denette
At least 20% of eligible Canadians fully vaccinated, 75% with one dose: data

Earlier projections for reopening at this milestone didn’t include Delta variant

This undated file photo provided by Ernie Carswell & Partners shows the home featured in the opening and closing scenes of The Brady Bunch in Los Angeles. Do you know the occupation of Mike Brady, the father in this show about a blended family? (Anthony Barcelo/Ernie Carswell & Partners via AP, File)
QUIZ: A celebration of dad on Father’s Day

How much do you know about famous fathers?

Emily Steele holds up a collage of her son, 16-year-old Elijah-Iain Beauregard who was stabbed and killed in June 2019, outside of Kelowna Law Courts on June 18. (Aaron Hemens/Capital News)
Kelowna woman who fatally stabbed teen facing up to 1.5 years of jail time

Her jail sentence would be followed by an additional one to 1.5 years of supervision

Cpl. Scott MacLeod and Police Service Dog Jago. Jago was killed in the line of duty on Thursday, June 17. (RCMP)
Abbotsford police, RCMP grieve 4-year-old service dog killed in line of duty

Jago killed by armed suspect during ‘high-risk’ incident in Alberta

The George Road wildfire near Lytton, B.C., has grown to 250 hectares. (BC Wildfire Service)
B.C. drone sighting halts helicopters fighting 250 hectares of wildfire

‘If a drone collides with firefighting aircraft the consequences could be deadly,’ says BC Wildfire Service

A dose of the Pfizer-BioNTech COVID-19 vaccine is pictured at a vaccination site in Vancouver Thursday, March 11, 2021. THE CANADIAN PRESS/Jonathan Hayward
NACI advice to mix vaccines gets varied reaction from AstraZeneca double-dosers

NACI recommends an mRNA vaccine for all Canadians receiving a second dose of a COVID-19 vaccine

A aerial view shows the debris going into Quesnel Lake caused by a tailings pond breach near the town of Likely, B.C., Tuesday, Aug. 5, 2014. THE CANADIAN PRESS/Jonathan Hayward
Updated tailings code after Mount Polley an improvement: B.C. mines auditor

British Columbia’s chief auditor of mines has found changes to the province’s requirements for tailings storage facilities

A North Vancouver man was arrested Friday and three police officers were injured after a 10-person broke out at English Bay on June 19, 2021. (Youtube/Screen grab)
Man arrested, 3 police injured during 10-person brawl at Vancouver beach

The arrest was captured on video by bystanders, many of whom heckled the officers as they struggled with the handcuffed man

Most Read