A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

The section of Princess Avenue from Young Road to Nowell Street, seen here on Thursday, Nov. 5, 2020, will be converted to one-way traffic to help increase parking in the area. (Jenna Hauck/ Chilliwack Progress file)
Chilliwack council opts to convert downtown street to one-way traffic to create parking

Council voted to start with Princess Avenue, holding off on converting Victoria Avenue until later

Uber Eats has announced that it is now delivering food orders in Abbotsford and Chilliwack. (Submitted photo by Justin Walker)
Uber Eats announces expansion into Chilliwack

Food-delivery company is starting with 60 local restaurants

Soon-to-be Sardis secondary grad Celeste Kirkness is heading north to play university soccer with the UNBC Timberwolves. (UNBC photo)
Sardis soccer’s Celeste Kirkness commits to UNBC Timberwolves

The Chilliwack soccer star will once more share the pitch with her older sister Kalista

Sardis Falcons alumni Rick Klassen led the B.C. Lions to a Grey Cup championship in 1985.
Sardis secondary football field to be named after Rick Klassen

Klassen, a Sardis grad, led the B.C. Lions to a Grey Cup championship in 1985

Emergency crews respond to a vehicle that hit a tree and went into a ditch on Camp River Road on Wednesday, Jan. 27, 2021. (Jenna Hauck/ Chilliwack Progress)
UPDATE: Two people rescued after car hits tree and spins into ditch in rural Chilliwack

Vehicle narrowly avoided landing in Camp River Slough after morning crash

Dr. Penny Ballem, a former deputy health minister, discusses her role in leading B.C.’s COVID-19 vaccination program, at the B.C. legislature, Jan. 22, 2021. (B.C. government)
B.C. holds steady with 407 new COVID-19 cases Tuesday

14 deaths, no new outbreaks in the health care system

Worker at Swartz Bay terminal on Monday, January 20, 2020. (THE CANADIAN PRESS/Chad Hipolito)
Ex-BC Ferries employee who says he was fired due to his race gets tribunal hearing

Former employee Imraan Goondiwala alleges ‘white surpremacy’ in the make-up of BC Ferries’ workforce

Some of the fake gold sold by con artists in B.C. RCMP said there have been reports of the scam in Richmond, Coquitlam, Burnaby, Langley and New Westminster from Jan. 17 through Jan. 22 (RCMP)
‘Dubai gold’ scam is back in the Lower Mainland

If someone offers to sell gold jewelry at a bargain, it’s probably fake, police warn

Rodney and Ekaterina Baker have been ticketed and charged under the Yukon’s Civil Emergency Measures Act for breaking isolation requirements in order to sneak into a vaccine clinic and receive Moderna vaccine doses in Beaver Creek. (Facebook/Submitted)
B.C. couple who travelled to Yukon for COVID vaccine ineligible for 2nd dose until summer

The province is ensuring those eligible to receive the vaccine get the second shot within 42 days

(File)
Mask dispute in court leaves Vancouver cop with broken leg

Man allegedly refused to put on a mask and resisted arrest

Cannabis bought in British Columbia (Ashley Wadhwani/Black Press Media)
Is it time to start thinking about greener ways to package cannabis?

Packaging suppliers are still figuring eco-friendly and affordable packaging options that fit the mandates of Cannabis Regulations

(Kraft Dinner/Twitter)
Kraft Dinner launches candy-flavoured mac and cheese just in time for Valentine’s Day

Sweet and cheesy treat will be here just in time for the cheesiest holiday of the year

SAR crews worked late into the night Tuesday to rescue an injured snowboarder in North Vancouver. (Facebook/North Shore Rescue)
Complicated, dangerous rescue saves man in avalanche near Cypress Mountain

North Shore SAR team braves considerable conditions to reach injured snowboarder

Most Read