More than five years after a massive data leak of personal information at Desjardins, Laval police announced Wednesday afternoon they have arrested three suspects.
Police are also “actively seeking a fourth individual,” said Jean-François Rousselle, assistant director of the Criminal Investigations Branch.
In December 2020, two damning reports about the data leak that affected more than 9.7 million people in Canada and abroad in 2019, including nearly seven million Quebecers, concluded that Desjardins had failed to meet several of its obligations under the Act Respecting the Protection of Personal Information in the Private Sector.
The report from the Commission d’accès à l’information du Québec noted that the bank had “failed in its obligation to limit access to personal information, particularly that stored in shared directories.”
The Desjardins employee who leaked the information was a member of the marketing team at Desjardins head office.
A Caisse populaire Desjardins sign is seen in Montreal on Tuesday, June 18, 2019. THE CANADIAN PRESS/Paul Chiasson
He had access to personal information that his database access rights did not allow him to obtain, the commission noted.
Contrary to directives, this confidential information was stored in directories shared by all marketing team employees.
– More to come.
This report by The Canadian Press was first published in French on June 12, 2024.