A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Justin Kripps of Summerland and his team have competed in Olympic action and World Cup competitions in bobsleigh. (Jason Ransom-Canadian Olympic Comittee).
QUIZ: Are you ready for some winter sports?

It’s cold outside, but there are plenty of recreation opportunities in the winter months

Half of the most expensive homes are on 2080 Mackenzie Crt, which is across the street from Revelstoke Mountain Resort. (Liam Harrap/Revelstoke Review)
The 10 most valuable homes in Revelstoke for 2020

Combined, the properties are worth more than $35M

A map released by the BCCDC on Jan. 15 shows the number of new COVID-19 cases reported for each local health area between Jan. 3 and 9. (BCCDC Image)
Salmon Arm and Vernon see increase in new COVID cases, curve flattening elsewhere

The rate of new cases is levelling off in Kelowna, Penticton and Revelstoke.

Snowboarders at Revelstoke Mountain Resort heading for the gondola. (Liam Harrap/Revelstoke Review)
Updated: Another 16 COVID-19 cases for Revelstoke

The cases were identified between Jan. 3 and 9

Interior Health update. File photo.
86 new COVID-19 cases, two more deaths in Interior Health

The new deaths are from Heritage Square, a long-term care facility in Vernon

Keith the curious kitten is seen on Nov. 4, 2020 at the Chilliwack SPCA. Friday, Jan. 22, 2021 is Answer Your Cat’s Questions Day. (Jenna Hauck/ Chilliwack Progress file)
Unofficial holidays: Here’s what people are celebrating for the week of Jan. 17 to 23

Answer Your Cat’s Questions Day, Pie Day and International Sweatpants Day are all coming up this week

(Phil McLachlan - Capital News)
‘Targeted’ shooting in Coquitlam leaves woman in hospital

The woman suffered non-life threatening injuries in what police believe to be a targeted shooting Saturday morning

The organizer of a Kelowna protest against COVID-19 restrictions was fined by the RCMP for the third time Saturday, Jan. 16, 2021. (File photo)
COVID-19: Organizer of Kelowna anti-restriction protest ticketed for third time

The individual’s latest ticket for $2,300 was handed out by RCMP at an anti-lockdown rally Saturday

Mount Boucherie Secondary School is one of three Kelowna schools with confirmed cases of COVID-19, according to an update from the school district Saturday, Jan. 16, 2021. (File photo)
COVID-19 confirmed at 3 Kelowna schools

Interior Health has confirmed exposures at Mount Boucherie, Springvalley and South Rutland schools

Lake Country native Evan-Riley Brown is in the cast for the new film Journey To Royal: A WW II Rescue Mission to be released on video on demand and streaming services on Feb. 2. (Contributed)
Okanagan actor lands role in WW II movie

Evan-Riley Brown, from Lake Country, cast in production labelled as hybrid of a feature film and documentary called Journey To Royal: a WW II Rescue Mission.

Join Black Press Media and Do Some Good
Join Black Press Media and Do Some Good

Pay it Forward program supports local businesses in their community giving

JaHyung Lee, “Canada’s oldest senior” at 110 years old, received his first dose of the COVID-19 vaccine on Thursday, Jan. 14, 2021. He lives at Amenida Seniors Community in Newton. (Submitted photo: Amenida Seniors Community)
More than 20 days have passed since the last case of COVID-19 was confirmed at Lakeside Manor. (File photo)
Salmon Arm retirement facility reopens social areas after COVID-19

More than 20 days have passed since last confirmed case at Lakeside Manor

A unique-looking deer has been visiting a Nanoose Bay property with its mother. (Frieda Van der Ree photo)
A deer with 3 ears? Unique animal routinely visits B.C. property

Experts say interesting look may be result of an injury rather than an odd birth defect

Most Read