Desjardins Data Breach Affecting 2.9 Million Members Caused By Employee Who's Since Been Fired

Freshly Exhumed shares a report from The Georgia Straight: The Quebec-based Desjardins Group has admitted to being victimized by one of the largest data breaches in Canadian history. Laval police informed the financial-services giant that personal information of more than 2.9 million members has been shared with people outside of the organization. This includes 2.7 million people and 173,000 businesses. "This situation is the outcome of unauthorized and illegal use of our internal data by an employee who has since been fired," Desjardins said in a statement. "In light of these events, and given the circumstances, additional security measures were put in place on all accounts." Desjardins, which is the largest federation of credit unions in North America, will be informing people by letters if they've been affected. The leaked data included first and last names, birthdates, social insurance numbers, addresses, phone numbers, email addresses, and details about banking habits. However, passwords, security questions, and PINs were not disclosed.

Re: Wtf did the fired lady do?

[The MAZZTer]

Probably took customer data home with her on an unencrypted laptop to work from home and it was stolen.

Re:

[Anonymous Coward]

Probably took customer data home with her on an unencrypted laptop to work from home and it was stolen.

First off, it was a man [www.cbc.ca]:

The employee, a man who has not been publicly identified, was fired. He was arrested by Laval police but has not been charged.

Second (from the same article), it sounds quite deliberate:

Officials at Desjardins revealed Thursday an employee improperly collected information about customers and shared it with a third party outside the financial institution, which is the largest federati

Re:

[jimtheowl]

Free credit monitoring is quickly becoming the new catch-all apology for bad actors in financial institutions.

I suspect they learned this from the IT industry, where instead of building quality products, you make bad ones and sell the fixes.

Not that it is intentional in this case, but monitoring is not much of a cost to them. Even better, after 5 years, it becomes lucrative.

Re:

[tlhIngan]

Free credit monitoring is quickly becoming the new catch-all apology for bad actors in financial institutions.

I suspect they learned this from the IT industry, where instead of building quality products, you make bad ones and sell the fixes.

Not that it is intentional in this case, but monitoring is not much of a cost to them. Even better, after 5 years, it becomes lucrative.

It's because it's cheap and ineffective. Credit monitoring is a joke - it only works with one of the three credit monitoring agencies,

Just fired?

[manu0601]

This situation is the outcome of unauthorized and illegal use of our internal data by an employee who has since been fired,

Fired and not sued? Wow, they are very nice with that person.

Re:

[sexconker]

Soorry aboot that, eh?

Re:Just fired?

[ve3oat]

Fired, yes. Also arrested by police, though not yet charged, according to CBC news this evening. (They are probably figuring out what exactly to charge the ex-employee with.)

Re:

[Anonymous Coward]

Fired and not sued? Wow, they are very nice with that person.

In Canada, you generally aren't suing someone once it's gone to being a criminal matter -- at least not until that is resolved so you don't interfere.

I know Americans will sue for damned near anything, but that isn't how most legal systems work.

Re:

[davecb]

If the person is a credible suspect, the police will lay charges under the Criminal Code. Only in the Excited States do individuals and companies sue criminals. Elsewhere they get arrested, then if and only if convicted, the stolen goods are returned to the person stolen from. At that point, they're welcome to sue for more.

WARNING! Thus far, the only one we've heard from is Desjardins. This could be an error, a blame-deflection, a put-up-job, or a real theft. We don't know which.

Look to see if the