Desjardins Data Breach: Lessons From an Insider Leak

The Desjardins breach did not start with a clever outside hacker. It started with an employee who already had a door key, and with data copied to places it did not need to be.

By Siddharth ShankarUpdated October 11, 2026

Most people picture a data breach as a stranger breaking in from outside. The Desjardins case is a reminder that the person who causes the damage can already be on the payroll. In its 2020 findings, Canada's federal privacy regulator described a breach of nearly 9.7 million people that ran for more than two years before anyone inside the company noticed.

What happened

According to the Office of the Privacy Commissioner of Canada, a malicious employee of Desjardins extracted personal information from the company's systems for at least 26 months. The OPC called it the largest data breach ever recorded in Canada's financial services sector. The company did not discover the problem itself. It learned of it only when police contacted it, after more than two years.

The OPC published its findings on December 14, 2020. Quebec's access to information commission and the province's financial markets authority released their own findings the same day, so the case was examined by several regulators at once.

How it worked

The employee had limited access to two data warehouses that held customer information. That limit mattered less than it should have, because other employees regularly copied data from those warehouses to a shared drive. Staff who had no clearance and no need to know could reach that drive.

Desjardins had policies that prohibited this kind of copying. What it lacked, in the OPC's words, were technical controls that would have stopped it. A rule on paper is not a barrier. When the only thing standing between a person and a large pool of records is a policy document, one bad actor is enough.

What was exposed

The OPC describes the information as sensitive personal information about people who bought or received Desjardins products. The release we reviewed does not list the specific fields, and we do not guess. What it does say is that the data sat in two central warehouses and that a second, wider copy lived on the shared drive.

The people affected were not only members who actively used the company. The OPC also found that Desjardins had no retention periods or procedures for destroying data it no longer needed. Without those, old records can stay in storage long after anyone has a reason to hold them.

How it ended

For the people affected, the ending is mixed at best. The OPC found inadequate access controls and data segregation, inadequate employee training, and missing retention rules. It also found that Desjardins knew about some weaknesses and had a plan to fix them, but did not complete the work in time.

There was no penalty in the release. Desjardins agreed to the recommendations, to report progress to the OPC every six months and to have external auditors certify its programs. The Commissioner said he was satisfied with the protective measures offered to the people affected.

Key facts at a glance

• People affected: nearly 9.7 million, according to the OPC
• Duration: at least 26 months
• How it was found: police told Desjardins, not its own monitoring
• Root causes found: weak access controls, shared-drive copying, weak training, no retention rules
• Outcome: commitments, six-month progress reports and external audits
• Date of the findings: December 14, 2020

What you can do

You cannot see how a company stores your records. You can limit the harm if they leak.

What the release does not say

The OPC release does not state which data fields were stolen, how the employee used them or what legal outcome followed for the individual. We have not filled those gaps from other coverage. For a different Canadian breach from a company supplier angle, see the LifeLabs health-data case.

Why this case matters

Two lessons from the Desjardins findings apply well beyond one company. First, access limits only help if copies are controlled too. The employee's own permissions were narrow, but copies of the data on a shared drive widened who could reach it. Second, detection mattered. A breach that runs for 26 months, and that the company learns about from police, tells you that internal monitoring did not catch unusual activity.

For a customer, the practical point is that you rarely get to choose how carefully a provider handles your records. What you can choose is how little you give, how unique your passwords are and how quickly you react to a notice.

If this case made you want to check your own position, start with these guides on how to prevent identity theft, what to do if your identity is stolen and when to freeze your credit. You can also try our free digital footprint check.