A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. The federal privacy watchdog says a series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest in the Canadian financial services sector. THE CANADIAN PRESS/Paul Chiasson

Series of gaps allowed massive Desjardins data breach, privacy watchdog says

The incident compromised the data of nearly 9.7 million Canadians

A series of technological and administrative gaps caused a high-profile data breach at Desjardins — the largest to date in the Canadian financial services sector, the federal privacy watchdog has found.

In a report today, privacy commissioner Daniel Therrien said Desjardins did not demonstrate the level of attention needed to protect the sensitive personal information entrusted to its care.

The incident compromised the data of nearly 9.7 million Canadians.

“Canadians expect banking information to have a high level of protection, given its sensitivity,” Therrien told a news conference today.

For at least 26 months, a malicious employee was siphoning sensitive personal information collected by Desjardins from customers who had purchased or received products through the organization, Therrien found.

This information was originally stored in two data warehouses to which the employee in question had limited access, the commissioner said.

However, other employees, in the course of fulfilling their work, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so, Therrien found.

The commissioner says the investigation into the breach sheds light on the risks of internal threats, whether they are intentional or not.

The investigation revealed that Desjardins failed to meet several of its obligations under the federal privacy law governing companies. Therrien found:

  • Desjardins did not ensure proper implementation of its policies and procedures for managing personal information, some of which were inadequate;
  • The access controls and data segregation of the company’s databases and directories were lacking;
  • Employee training and awareness were inadequate, considering the sensitive nature of the personal information;
  • Desjardins did not have proper procedures regarding the periodic destruction of personal information.

Desjardins agreed to a series of recommendations to improve information security and the protection of personal data, Therrien said.

The company has committed to provide progress reports every six months as well as hire external auditors to assess and certify its programs.

Therrien’s office and the Commission d’accès à l’information du Québec, which also published its report today, co-ordinated their respective probes.

Jim Bronskill, The Canadian Press

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

Just Posted

Fruit farmers in the Okanagan and Creston valleys are in desperate need of cherry harvesters amid COVID-19 work shortages. (Photo: Unsplash/Abigail Miller)
‘Desperate’ need for workers at Okanagan cherry farms

Fruit farmers are worried they’ll have to abandon crops due to COVID-19 work shortages

JAK's Liquor Store in Penticton will be donating 10 per cent of its sales on Saturday, June 19, to the Penticton Salvation Army Food Bank. (Photo from JAKS.com)
Stock up your liquor cabinet and support the Penticton food bank

Jak’s beer and wine store is donating a portion of sales to local food banks Saturday

A tent housing a mobile vaccination clinic. (Interior Health/Contributed)
Over 5K jabbed at Interior Health mobile COVID-19 vaccine clinics

The clinics have made stops in more than 40 communities since launching last week

The illegal open fire above Naramata continues to smoke on Friday, June 18. The fire was left to burn itself out by BC Wildfire. (Monique Tamminga - Western News)
Illegal open burn in Naramata will be left to smoke

BC Wildfire could not confirm whether the property owner had been fined

Provincial Health Officer Dr. Bonnie Henry talks about B.C.’s plan to restart the province during a press conference at Legislature in Victoria, Tuesday, May 25, 2021. THE CANADIAN PRESS/Chad Hipolito
Interior Health COVID-19 cases falling slower than the rest of B.C.

More than a third of provincial cases announced Thursday came from the Interior

A small pod of Pacific white-sided dolphins pass by close to shore in Campbell River June 16, 2021. Still capture from video courtesy of Kimberly Hart
VIDEO: Dolphin sunset captured from Vancouver Island shore

Spectacular setting for view of travelling pod of Pacific white-sided dolphins

Earls On Top at 211 Bernard Avenue in Kelowna. (Google Maps photo)
Downtown Kelowna’s Earls ordered closed after COVID-19 transmission

Earls on Top on Bernard Avenue will be closed from June 18 to June 27

A motorycle crash has been reported on Westside Road. (Google Maps)
UPDATE: Westside Road reopened following motorcycle crash near Vernon

AIM Roads advises drivers to expect delays due to congestion

(File photo)
Penticton not holding Canada Day activities out of respect for Indigenous people

Cities across B.C. are cancelling the holiday after an increased spotlight on Canada’s dark history

Dereck Donald Sears. (Contributed/Crimestoppers)
Murder charge laid in relation to suspicious Kelowna death

Dereck Donald Sears is charged with second-degree murder in the death of Darren Middleton

Police are asking for public assistance in locating Anthony Graham who has been charged with the murders of Kamloops brothers Carlo and Erick Fryer. (RCMP photo)
2 charged, suspect at large in killings of B.C. brothers linked to gang activity: RCMP

Kamloops brothers Erick and Carlo Fryer were found deceased in May on a remote Okanagan road

Albert Health Minister Tyler Shandro and Alberta Premier Jason Kenney unveil an opening sign after speaking about the Open for Summer Plan and next steps in the COVID-19 vaccine rollout, in Edmonton, Friday, June 18, 2021. THE CANADIAN PRESS/Jason Franson
Alberta 1st province in Canada to lift all COVID-19 public health restrictions

70.2% of eligible citizens 12 and older in the province have received a dose of the vaccine

Fraser Health registered nurse Ramn Manan draws a dose of the Pfizer COVID-19 vaccine into a syringe at a walk-up vaccination clinic at Bear Creek Park, in Surrey, B.C., on Monday, May 17, 2021. THE CANADIAN PRESS/Darryl Dyck
‘Honour our fathers’ with COVID-19 vaccine protection, B.C. urges

109 new cases Friday, 75 per cent of 12 and up immunized

Most Read