A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Best of Lacombe
Vote for the Best of Lacombe Readers’ Choice Awards 2021

Vote until June 6th, and the results will be published June 24th, 2021

Karlee Prins standing in front of Lacombe City Cinema. (Photo Submitted)
Lacombe resident creates Go Fund Me page to help ailing Lacombe City Cinema

Karlee Prins created a Go Fund Me Page the help the local theatre and family who own it

(Photo Courtesy of Red Deer Catholic Regional Schools)
Red Deer Catholic Regional Schools will not pilot draft curriculum

RDCRS is one of many divisions in the area to opt out of the pilot of the K-6 draft curriculum

FILE - In this March 3, 2021, file photo, a vial of the Johnson & Johnson COVID-19 vaccine is displayed at South Shore University Hospital in Bay Shore, N.Y. (AP Photo/Mark Lennihan, File)
Johnson & Johnson COVID vaccine can be given to adults 30+ who can’t wait for mRNA: NACI

Panel says single shot vaccine can be especially useful for populations unable to return for second shot

Alberta’s environment department has known for years that toxins from old coal mines are contaminating populations of the province’s official animal, the bighorn sheep. THE CANADIAN PRESS/Craig Bihrl
Alberta government knew bighorn sheep contaminated with coal mine selenium, scientist says

Jeff Kneteman says Alberta Environment has known about the problem in bighorn sheep for years

Prime Minister Justin Trudeau receives his COVID-19 AstraZeneca vaccination in Ottawa, Friday, April 23, 2021. THE CANADIAN PRESS/Adrian Wyld
75% of Canadians need 1st vaccine dose to have more normal summer: Trudeau

The country is on track to hit a major milestone on the road to COVID-19 herd immunity Tuesday, with 40% vaccinated with a 1st dose

A vial of the AstraZeneca COVID-19 vaccine.THE CANADIAN PRESS/Carlos Osorio
Alberta to stop giving first doses of AstraZeneca COVID-19 shot as supply dwindles

There aren’t any confirmed shipments of AstraZeneca coming, and the province only has 8,400 doses of it left

Winnipeg Jets’ Andrew Copp (9) and Edmonton Oilers goaltender Mike Smith (41) watch an incoming shot during second period NHL action in Winnipeg, Monday, April 26, 2021. THE CANADIAN PRESS/Fred Greenslade
‘Very jealous’: Canadian teams can’t take advantage of NHL’s relaxed COVID-19 rules

League eased some tight COVID-19 health and safety protocols over the weekend for fully vaccinated clubs

File photo
Arrest made for armed robbery in Millet, Wetaskiwin RCMP continue to investigate

Wetaskiwin RCMP are investigating an armed robbery took place May 4, 2021 in Millet, Alta.

Dr. Karina Pillay, former mayor of Slave Lake, Alta., is shown at her medical clinic in Calgary on Friday, April 16, 2021. THE CANADIAN PRESS/Jeff McIntosh
10 years later: Former Slave Lake mayor remembers wildfire that burned through town

Alberta announced in 2011 that an unknown arsonist had recklessly or deliberately ignited the forest fire

The body of Brenda Ware, 35, was found along Highway 93 in Kootenay National Park on Thursday, May 6, 2021. (RCMP handout)
RCMP ask for tips after woman travelling from Alberta found dead in B.C. park

Brenda Ware was found along Highway 93 in the park, 54 kilometres north of the town of Radium

A caribou grazes on Baffin Island in a 2008 file photo. A last-ditch attempt to save some of Canada’s vanishing caribou herds is a step closer after a scientific review panel’s approval of a plan to permanently pen some animals and breed them to repopulate other herds. THE CANADIAN PRESS/AP-Kike Calvo via AP Images
Parks Canada captive caribou breeding proposal gets OK from scientific review panel

Wolf density in Jasper is low enough that the animals would not be expected to be a major threat

Most Read