Laval police say they arrested three suspects Wednesday in connection to a massive data breach at Desjardins Group made public in 2019.
The suspects face charges including fraud, trafficking in identity information and identity theft.
An arrest warrant was also issued for a fourth suspect.
The data breach at the Quebec-based bank is thought to be one of the largest ever among Canadian financial institutions, affecting roughly 4.2 million people and 173,000 businesses.
Laval police criminal investigations assistant director Jean-François Rousselle said one of the suspects had a list of 1.6 million Quebecers’ personal information.
The leaked information includes names, addresses, birth dates, social insurance numbers (SINs), email addresses and information about transaction habits.
In 2022, the Superior Court of Quebec approved a more than $200-million settlement of a class-action lawsuit related to the breach.
More to come.