A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Just Posted

Students at Creston Valley Secondary School put together an art installation of a replica residential school room. (Photo by Kelsey Yates)
Creston students create art installation of residential school room

The replica was decorated with a small bed, school uniform, and notes written with pleas for help

An example of the kinds of invasive plants that can be found in Golden. (Tesia Hackett photo)
Golden annual weedpull back for 14th year

Invasive plants can be harmful to local ecosystems, Wildsight says

A tent housing a mobile vaccination clinic. (Interior Health/Contributed)
Second dose vaccinations accelerating throughout region: Interior Health

To date, more than 675,000 doses have been administered throughout the region

BC CDC map showing the geographic distribution of cases in the province. (BC CDC photo)
No new cases of COVID-19 in Golden

The last time the BC CDC reported a new case in the area was the week of May 23-29

Prince Charles Secondary School
School District 8 votes in favour of name change for Secondary School in Creston

In an act of reconciliation, a new name will be chosen for Prince Charles Secondary School

Bear wanders Kelowna on June 15. (Michelle Wallace/Facebook)
Bear climbs fence, uses crosswalk in Kelowna

The bear was spotted on Baron Road Wednesday evening

Hundreds of people, young and old, joined the three-day Walking Our Spirits Home procession, honouring residential school survivors, those who never made it home and all those affected by the institutions. Here people walk the third portion on June 13. (Martha Wickett - Salmon Arm Observer)
Walking Our Spirits Home from Kamloops provides path to healing

First Nations in and beyond Secwépemc territory join in to honour residential school survivors

More flames
Lake Country home destroyed in large blaze, 11 dogs rescued

Fire crews are responding to 10839 Hallam Drive

(Facebook/Kelowna Cabs)
Kelowna Cabs reaches tentative agreement with dispatchers union

The tentative agreement could help end the dispute between the taxi company and the dispatchers

FILE – A science class at L.A. Matheson Secondary in Surrey, B.C. on March 12, 2021. (Lauren Collins/Surrey Now Leader)
Teachers’ union wants more COVID transmission data as B.C. prepares for back-to-school

BCTF says that details will be important as province works on plan for September

201 First Street West 1980s. Prior revitalization. (Photo from Revelstoke Museum and Archives)
Man who redesigned downtown Revelstoke honoured with lifetime achievement award

Robert Inwood has worked on historical projects across the province

Provincial health officer Dr. Bonnie Henry outlines B.C.’s COVID-19 restart plan, May 25, 2021, including larger gatherings and a possible easing of mandatory masks on July 1. (B.C. government photo)
B.C. records 120 new COVID-19 cases, second vaccines accelerating

Lower Pfizer deliveries for early July, Moderna shipments up

The weekly COVID-19 map for June 6 to 12. (BC CDC)
South Okanagan sees only 5 new cases in last week

The Similkameen Valley went a second week without any new cases

Most Read