A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

As of Friday, Alberta has under 10,000 active COVID-19 cases. (Image courtesy CDC)
Three new COVID-19 deaths in Central zone, Alberta under 10,000 active cases

The Central zone sits at 849 active cases, with 52 people in hospital and 10 in the ICU.

Stettler sign
Stettler Community Builders initiaitve continues to take shape

Project will honour Stettler citizens who were influential in the town’s history

World Juniors’ referee Mike Langin makes a called during the Canada vs. Slovakia at the 2021 World Junior Championship at Rogers Place in Edmonton, Dec. 27, 2020. (Photo by Matthew Murnaghan/Hockey Canada)
Former Sylvan Lake man lives his dream at World Junior Championships

Mike Langin was one the 25 Canadian officials who worked during the tournament

Alberta’s chief medical officer of health Dr. Deena Hinshaw announced 16 additional deaths Thursday. (Photo by Chris Schwarz/Government of Alberta)
No easing of Alberta’s COVID-19 measures Thursday, 678 new COVID-19 cases

The province also hit 1,500 COVID-19 deaths since the beginning of the pandemic

Stettler town hall. (Lisa Joy/Stettler Independent)
The proposed Stettler Skate Park expansion is one more step closer to fruition

The third phase of the skateboard park will see a concrete ‘bowl’ added to the edge of the existing skatepark

Alberta’s chief medical officer of health, Dr. Deena Hinshaw, updates media on the COVID-19 situation in Edmonton, Friday, March 20, 2020. Hinshaw says residents in long-term care and supportive living facilities will remain the priority as the province grapples with a looming slowdown in COVID-19 vaccine supply. THE CANADIAN PRESS/Jason Franson
Alberta long-term care residents remain priority in looming slowdown of COVID vaccine

There are 119 patients in intensive care and 1,463 people have died

Black Press File Photo
Maskwacis RCMP lay charges for attempted murder, kidnapping, and flight from police

Female victim remains in hospital in serious condition.

In this Dec. 18, 2020 photo, pipes to be used for the Keystone XL pipeline are stored in a field near Dorchester, Neb.  THE CANADIAN PRESS/AP-Chris Machian /Omaha World-Herald via AP
‘Gut punch’: Alberta Premier Jason Kenney blasts Biden on revoked Keystone XL permit

Kenney said he was upset the U.S. wouldn’t consult with Canada first before acting

Joe Biden, then the U.S. vice-president, and Prime Minister Justin Trudeau take their seats at the start of the First Ministers and National Indigenous Leaders meeting in Ottawa, Friday, Dec. 9, 2016. THE CANADIAN PRESS/Adrian Wyld
Trudeau, Biden to talk today as death of Keystone XL reverberates in Canada

President Joe Biden opposed the Keystone XL expansion as vice-president under Barack Obama

Prince Edward Island’s provincial flag flies on a flag pole in Ottawa, Friday July 3, 2020. A lozenge plant in Prince Edward Island has laid off 30 workers, citing an “almost non-existent” cold and cough season amid COVID-19 restrictions. THE CANADIAN PRESS/Adrian Wyld
‘Almost non-existent’ cold and cough season: P.E.I. lozenge plant lays off 30 workers

The apparent drop in winter colds across the country seems to have weakened demand for medicine and natural remedies

Gov. Gen. Julie Payette takes the royal salute from the Guard of Honour as she makes her way deliver the the throne speech, Wednesday, September 23, 2020 in Ottawa. THE CANADIAN PRESS/Fred Chartrand
Gov. Gen. Julie Payette resigns, apologizes for ‘tensions’ at Rideau Hall

Payette, who is the Queen’s representative in Canada, has been the governor general since 2017

Grounded WestJet Boeing 737 Max aircraft are shown at the airline’s facilities in Calgary, Alta., Tuesday, May 7, 2019. WestJet will operate the first commercial Boeing 737 Max flight in Canada today since the aircraft was grounded in 2019 following two deadly crashes. THE CANADIAN PRESS/Jeff McIntosh
Passengers unfazed as WestJet returns Boeing 737 Max to service on Calgary flight

After a lengthy review process, Transport Canada cleared the plane to return to Canadian airspace

(Photo submitted)
Community Futures brings back Social Media Challenge for 2021

This time the challenge is for non-profits and community groups

Lucas Berg, left, with the backpacks filled with essential items he donated to the Red Deer Mustard Seed Jan. 19, 2021. (Photo submitted)
Central Alberta teenager donates filled 20 backpacks to Red Deer Mustard Seed

Lucas Berg, 14, of Ponoka County says he ‘just wants to help people’

Most Read