Police arrest 3 in connection with massive Desjardins data breach

Laval police say they arrested three suspects Wednesday in connection to a massive data breach at DesjardinsGroup made publicin 2019.

Update:4 more arrests, including primary suspect, in connection with Desjardins data breach

Imad Jbara, 33, and Ayoub Kourdal, 36, were charged with fraud, trafficking in identity information and identity theft. The third suspect has yet to appear in court.

An arrest warrant was also issued for a fourth suspect.

The data breach at the Quebec-based credit union isthought to be one of the largest ever among Canadian financial institutions, affecting millions of customers.

A suspicious transaction in Laval in December 2018 tipped off Desjardins.

Laval, Que., police criminal investigations assistant director Jean-Franois Rousselle said one of the suspects had a list of 1.6 million Quebecers' personal information.

The leaked information includes names, addresses, birth dates, social insurance numbers (SINs), email addresses and information about transaction habits.

Using the personal information gathered, the scammers would get a temporary password to log intoAccsD, Desjardins' login portal, to then make fraudulent transactions directly from the victims' account, said Rousselle.

Business accounts were mainly targeted this way, and $8.9 million fraudulently transferred from Desjardins clients and was never recovered.

Ina statement to Radio-Canada, Desjardins praised the work of police and said it would continue to co-operate.

Desjardinsfound negligent

In 2022, the Superior Court of Quebec approved a more than $200-million settlement of a class-action lawsuit related to the breach.

Reportsby theOffice of the Privacy Commissioner of Canadaand the Commission d'accs l'information du Qubec, the province's access-to-information commission,saidDesjardins failed to live up to its obligations andwas negligent in safeguarding its members' personal and financial information.

The financial institution paidfor a credit-monitoring plan through Equifax and offeredidentity theft insurance for affected members forfive years, which is expiring soon.

The Desjardins employee behind the leak worked in the marketing team at its head office and had access to personal informationhis database access rights did not allow him to obtain, saidthe Commission d'accs l'information.

This confidential information was stored in directories shared by all marketing team employees.

Police reports related to fraud increased by 20 per cent in 2023 in Laval, similarly to the rest of Quebec, according to Rousselle.

"Scammers are ingenious and are always innovating their strategies to get more money out of their victims," he said.

"No one is safe from fraud. Never share your personal information, bank information or give money to someone without confirming their identity."