Combination of weaknesses led to massive data breach at Desjardins

Original Post

GATINEAU, QC, December 14, 2020 – A data breach at Desjardins – the largest ever in the Canadian financial services sector – was caused by a series of gaps in administrative and technological safeguards, according to an investigation by the Office of the Privacy Commissioner of Canada (OPC).

The OPC today published its investigative report of findings into the incident, which compromised the data of nearly 9.7 million Canadians.

The OPC and the Commission d’accès à l’information du Québec, which also published its decision today, coordinated their respective investigations. The Autorité des marchés financiers du Québec is also publishing the results of its own investigation today.

“Desjardins did not demonstrate the appropriate level of attention required to protect the sensitive personal information entrusted to its care,” says Daniel Therrien, Privacy Commissioner of Canada. “The organization’s customers and members, and all citizens, were justifiably shocked by the scale of this data breach. That being said, we are satisfied with the mitigation measures offered to those affected and the commitments made by Desjardins.”

Desjardins had recognized some of the security weaknesses that ultimately led to the breach and had developed a plan to remedy them. Nonetheless, it failed to rectify the issues in time to prevent what happened. Moreover, the breach occurred over more than a two-year period before Desjardins became aware of it, and then only after the organization had been notified by the police.

According to the Personal Information Protection and Electronic Documents Act (PIPEDA), personal information must be protected by security safeguards appropriate to the sensitivity of the information. This represents a significant, but nonetheless crucial, task for a financial institution with complex systems and that maintains a large number of business relationships.

The investigation into the breach at Desjardins sheds light on the risks of internal threats, whether they are intentional or not. The OPC stresses the importance of vigilance and a holistic approach to addressing and mitigating the impact of such threats.

For at least 26 months, a malicious employee was exfiltrating sensitive personal information collected by Desjardins from customers who had purchased or received products offered directly or indirectly by the organization.

This information was originally stored in two data warehouses to which the malicious employee had limited access. However, other employees, in the course of fulfilling their duties, would regularly copy that information onto a shared drive. As a result, employees who would not usually have the required clearance or the need to access some of the confidential data were able to do so. While these practices violated the financial institution’s policies, the technological measures in place to prevent these situations were lacking at the time of the breach.

At the end of the investigation, Desjardins agreed to a series of recommendations to improve its program for information security and the protection of personal information, including its data destruction practices. It committed to provide progress reports to the OPC every six months. The financial institution also agreed to engage external auditors to assess and certify its programs and to submit an assessment report to the OPC.

The OPC’s investigation revealed that Desjardins had failed to meet several of its obligations under PIPEDA, including:

• Desjardins failed to ensure the proper implementation of its policies and procedures for managing personal information, some of which were inadequate to begin with.
• From a technological standpoint, the access controls and data segregation of the databases and directories were inadequate.
• Employee training and awareness were lacking considering the sensitive nature of the personal information the organization was entrusted with.
• Desjardins had not implemented retention periods or procedures regarding the destruction of personal information.

Related documents

PIPEDA Report of Findings: Investigation into Desjardins’ compliance with PIPEDA following a breach of personal information between 2017 and 2019

Commission d’accès à l’information du Québec news release (French only)

Preventing and responding to a privacy breach, advice for businesses

Receiving a privacy breach notification, advice for individuals

Contact information for media

Office of the Privacy Commissioner of Canada
communications@priv.gc.ca

Commission d’accès à l’information du Québec
isabelle.gosselin@cai.gouv.qc.ca