Data breach reference · June 2019

The Desjardins data breach

What was disclosed and how to check whether your address was in it.

At a glance
Disclosed
20 June 2019
Records
9,700,000 (Office of the Privacy Commissioner of Canada)
Type
Insider data exfiltration
Sector
Financial Services

Check whether your address was in it

No account needed. The address is used only to run the check. Privacy

This disclosure

What is on the record.

9,700,000
Records reported in the disclosure
2,692 days
Since the disclosure, 20 Jun 2019

Source: Office of the Privacy Commissioner of Canada, as recorded in the LeakTrace tracker.

What happened

Between 2017 and 2019, a Desjardins employee copied personal information belonging to members onto a shared network drive and eventually shared it externally. Names, addresses, dates of birth, Social Insurance Numbers, email addresses, phone numbers, and details of transaction habits were exposed for approximately 9.7 million individuals and businesses.

The federal Privacy Commissioner and Quebec regulator found Desjardins had inadequate access controls that let a single employee siphon data across multiple internal systems without detection for years. The incident is one of the most-cited insider-threat cases in Canadian financial services.

Reported impact: $201M CAD estimated response cost

Source: Office of the Privacy Commissioner of Canada, 20 Jun 2019.

What to do if you were affected

  1. Place a fraud alert on your credit file with Equifax and TransUnion.
  2. If you are or were a Desjardins member, request a copy of your credit report annually.
  3. Watch statements and monitor for unfamiliar credit inquiries.
  4. Consider a credit freeze if you are not actively opening new accounts.
  5. Update passwords on any account that shared credentials with Desjardins-linked services.

Common questions

When was the Desjardins breach disclosed?
In June 2019. Public reporting was carried by Office of the Privacy Commissioner of Canada.
How many people were affected?
9,700,000 records, by the figure in the disclosure. Whether your own details were among them depends on your relationship with Desjardins at the time.
How do I check whether my address was in it?
Enter the address in the check above. We check that one address against monitored breach databases and show what was exposed and what to do first. No account needed.
Is the data still a risk years later?
Often, yes. Lists from old breaches keep being copied and reused, so a password from one can still be tried today. Changing it and not reusing it, closes that door.

Is your address in a public breach? Check my address →