Desjardins data breach: Laval police arrest 3 suspects, fourth one being sought

More than five years after a massive data leak of personal information at Desjardins, Laval police announced Wednesday afternoon they have arrested three suspects.

Montreal-area police announced Wednesday that they have arrested three people in connection with a major data theft and $8.9-million fraud involving the co-operative financial group Desjardins, some five years after the alleged crime.

Police in Laval, Que., said one of the suspects was caught with a list of personal data for 1.6 million Quebecers.

The arrests are tied to a 2019 data theft, described as the largest ever in the Canadian financial services sector, that targeted more than 9.7 million Desjardins clients in Canada and internationally, including almost seven million Quebecers.

Laval police deputy director of criminal organizations Jean-François Rousselle said the suspects were allegedly able to use the stolen personal information to get access to the clients' accounts through the bank's online banking platform, Accès D. 

“These individuals used the data stolen from Desjardins in order to facilitate the conduct of their operations and to disperse funds in Canada, the United States, but also throughout the world," Rousselle said.

"The main method of operation was to obtain, via the Accès D service, a temporary password using the users' personal information that they had in their possession, to then proceed with transactions made directly from bank accounts via the web platform."

Police said the three suspects used the stolen data to commit fraud totalling $8.9 million between September 2018 and January 2019.