Breach Reference
Scan your email →
Data breach reference · June 2019

Were you affected by the Desjardins breach?

Disclosed
Jun 20, 2019
Records affected
9,700,000
Type
Insider data exfiltration
Sector
Financial Services

Check if your email appears in this breach.

One-click check against public breach records. No account required.

Takes 60 seconds. We never store your email address.

What happened

Between 2017 and 2019, a Desjardins employee copied personal information belonging to members onto a shared network drive and eventually shared it externally. Names, addresses, dates of birth, Social Insurance Numbers, email addresses, phone numbers, and details of transaction habits were exposed for approximately 9.7 million individuals and businesses.<br><br>The federal Privacy Commissioner and Quebec regulator found Desjardins had inadequate access controls that let a single employee siphon data across multiple internal systems without detection for years. The incident is one of the most-cited insider-threat cases in Canadian financial services.

Between 2017 and 2019, a Desjardins employee copied personal information belonging to members onto a shared network drive and eventually shared it externally. Names, addresses, dates of birth, Social Insurance Numbers, email addresses, phone numbers, and details of transaction habits were exposed for approximately 9.7 million individuals and businesses.

The federal Privacy Commissioner and Quebec regulator found Desjardins had inadequate access controls that let a single employee siphon data across multiple internal systems without detection for years. The incident is one of the most-cited insider-threat cases in Canadian financial services.

Reported impact: $201M CAD estimated response cost

Source: Office of the Privacy Commissioner of Canada

What to do if you were affected

Common questions about the Desjardins breach

When did the Desjardins breach happen?
The breach was disclosed in June 2019. Public reporting was carried by Office of the Privacy Commissioner of Canada. The incident is categorized as: Insider data exfiltration.
How many people were affected?
Approximately 9700000 records were reported affected. Whether your specific data was among them depends on your relationship with Desjardins during the exposure window.
How do I check if my email was in this breach?
Enter your email in the scan form above. LeakTrace runs a check against known breach records and returns the result in under a minute. No account required.
What should I do if my data was exposed?
• Place a fraud alert on your credit file with Equifax and TransUnion.
• If you are or were a Desjardins member, request a copy of your credit report annually.
• Watch statements and monitor for unfamiliar credit inquiries.
• Consider a credit freeze if you are not actively opening new accounts.
• Update passwords on any account that shared credentials with Desjardins-linked services.
Is my data still at risk years later?
Yes. Breach data from years past continues to circulate on active infostealer channels and credential-stuffing marketplaces. The passage of time does not neutralize the exposure. Ongoing monitoring catches new exposures as they land instead of only the ones already disclosed publicly.