How a Shared Folder and USB Keys Exposed 9.7 Million People at Desjardins

Introduction

In May 2019, Desjardins Group, a Québec financial cooperative, learned about its data leak from the police, not its own systems. Officers in Laval, just outside Montreal, were investigating fraud against its members, and on May 22 they brought Desjardins data that traced back to the cooperative. Its first report to the privacy regulator covered about 16,000 people. Nineteen months later, that number was 9.7 million.

Regulators traced the files from a company data warehouse to a marketing employee's USB keys. Almost every step used access he had been given. The one step company policy didn't allow, copying member data to USB, was also the one step nothing blocked.

How Member Data Went Unguarded

Desjardins kept member data in two warehouses that its marketing team searched through an analysis tool, and each had different access rules. The Commission d'accès à l'information du Québec found the banking warehouse had a confidential section, reviewed every 12 to 18 months. The credit warehouse had neither, so names, social insurance numbers, dates of birth, and addresses were open to anyone allowed into it.

The employee, a senior business strategy advisor in marketing, had access to credit data. He "did not have access rights to personal information held in the banking data warehouse," the federal privacy commissioner found.

Copies Anyone Could Open

Neither warehouse's rules covered the shared folders where colleagues saved copies from both. Against an internal directive, they copied warehouse data into folders open to all of marketing, "regardless of their access rights to the data warehouses."

A monthly script did it for credit data from January 2016 to June 2018, and restricted banking data followed on September 18, 2017, and November 13, 2018. From then on, anyone in marketing could open the confidential banking data, and no access review covered the shared folders.

How the Files Walked Out on USB Keys

With the data in open folders, the employee needed only his own login and a USB port. The Québec commission says the copying may have begun in March 2017 and went undetected for 26 months.

Using what the Québec decision calls "his own scripts," he combined his credit data with the banking files colleagues had left and saved the result to the shared drive. He copied the files to his workstation with the team's approved transfer software, then onto USB keys.

A USB Port Left On

Desjardins' chief operating officer told a House of Commons committee in July 2019 that the employee "found a way to circumvent all the rules." The regulators found nothing to circumvent at the last step. The Québec commission found that USB blocking "was not activated for the employees of the marketing team," with "no physical limit on the volume of data."

Desjardins' own standard banned personal information on devices it didn't own. "Despite the existence of this directive, Desjardins' systems did not prevent the use of personal removable storage devices," the federal report says.

From 16,000 to 9.7 Million

"Before that, we had no internal indication," the chief operating officer told Québec's National Assembly. The count of the number of people whose data was affected grew in stages:

• June 2019: Desjardins announced 2.9 million members, based on Laval police figures.
• November 2019: 4.2 million, based on provincial police figures.
• December 2019: about 1.8 million cardholders added, CBC reported.
• August 2020: 9.7 million, which Desjardins described as the files the employee "had access to." About 3.9 million belonged to people who had already left Desjardins, the federal commissioner found.

With no record of the USB copies, the Québec commission found, Desjardins could not know how many extractions the employee made or how many people were affected.

What the Leak Cost Desjardins

Desjardins booked C$108 million in 2019 to protect members' identities, Global News reported, and later budgeted C$150 million for a new security office. The fallout ran for six more years.

Three Rulings and No Fine

On December 14, 2020, three regulators published their rulings at once, and none fined Desjardins:

• The Québec commission ordered progress reports every six months and an independent audit.
• The Autorité des marchés financiers (AMF) issued order 2020-PDG-0074 for monthly reports on progress and remaining risk. Its only financial penalty was $10,000 a day if Desjardins failed to comply.
• The federal privacy commissioner issued findings under PIPEDA, which gave it no power to fine.

The AMF found "significant deficiencies in each of Desjardins Group's three lines of defence," and a board that had not held management to account for timely fixes.

Québec's Law 25 has since raised the stakes. Since September 2023, the same failures can draw administrative penalties of up to $10 million or 2% of worldwide turnover, and penal fines of up to $25 million or 4%, whichever is greater. The law doesn't reach back to 2019.

A Settlement, Charges, and the Data's Return

A class settlement approved in June 2022 was worth up to $200,852,500, with no admission of liability. First-year identity-theft claimants received $935.45 each, Radio-Canada reported.

In June 2024, provincial police charged the former employee and alleged buyers of the lists, and he and five co-accused pleaded not guilty. Two men in a linked $8.9 million fraud on members' AccèsD accounts were sentenced in January 2026.

By October 2025, an extortion group had posted the names, birth dates, and social insurance numbers of 3.8 million Desjardins clients from the 2019 data, La Presse reported. The same post asked for contacts inside large companies, a call for the next insider.

Copying files from a work computer to USB keys is path T1 in the ORION Data Loss Threat Model, Wired Upload to External Storage.

What Would Have Stopped the First Copy

The risk wasn't a surprise. The AMF's chief executive told the National Assembly in November 2019 that his agency had flagged "the possible risk of a massive data theft by a malicious employee" and asked Desjardins, among others, to strengthen its controls.

Desjardins' own data loss prevention rollout had rated "a high risk of data loss via physical vectors such as USB keys," and the theft was "precisely one of the scenarios envisioned," the federal commissioner found. The rollout reached email in 2018 and web traffic in 2019, but USB blocking was still unfinished when the police called. Logs were read "only after incidents were reported."

Even the locked-down analysis environment Desjardins built after the breach let "small file transfers" through "without requiring approval," until it switched to judging sensitivity instead of size.

Blocking USB alone doesn't close the gap, either. Morgan Stanley had restricted removable storage when an employee took data on about 730,000 accounts by uploading it to his own server instead, and the SEC fined the firm $1 million in 2016.

How Our Platform Would Have Seen It

Copying files from a work computer to USB keys is path T1 in the ORION Data Loss Threat Model, Wired Upload to External Storage. The model counts a USB key as an unmanaged device “regardless of ownership,” because it sits outside company controls. The model’s own example of T1 is almost the same: an employee copying code from a work laptop to a personal USB drive. 

If the employee’s workstation had been running ORION’s endpoint sensor, his first copy of member files to a USB key would have been denied, possibly in 2017, two years before the police called. ORION’s verdict weighs what a file holds, who is moving it, and where it’s going, so even a small file of member records with social insurance numbers, headed from a marketing account to a USB key, would have been stopped.

LLM-based classification finds member records and social insurance numbers in the file itself, and identity context supplies the employee's role and department. Because a verdict can allow, warn, or deny, a team can keep USB access for files with no member data instead of needing an exemption from a blanket block.

PIPEDA's breach record rules already applied in 2019, and Law 25 now requires a register of every incident. ORION keeps a record of each attempt and its verdict, the history the Québec commission found Desjardins could not produce.

Conclusion

Every step before the last used access Desjardins had granted, and the control for the last one was written and planned but not switched on for the team that moved the data. That copy is path T1 in our Data Loss Threat Model, a managed device handing data to an unmanaged one, whether a USB key, a personal laptop, or a phone on a cable.

 Book a demo to see ORION put a verdict on member records as they're copied to USB.

FAQs

How Did a Marketing Employee Reach Data He Wasn't Cleared For?

Through copies colleagues had put in shared folders the whole team could read. ORION judges the file rather than the folder it sat in, so a copy that drifted into an open share still meets a verdict when it's copied to USB.

How Do You Count Affected Customers After an Insider Leak?

With a record made when each file moved. Desjardins had none for the USB copies, so its count climbed on police figures and ended at every file the employee could reach. ORION keeps every attempt with its verdict.

Where Does an Insider Go When the USB Port Is Blocked?

To the next exit, which for Morgan Stanley's employee was an upload to a personal server. With our endpoint sensor and browser extension, ORION judges the same file when it's copied to USB and when it's uploaded to an outside site, paths T1 and T3.

How Would Québec's Law 25 Treat an Ignored Warning Today?

Penal sentencing weighs any failure to follow recommendations or warnings meant to prevent the offence, which could include a company's own risk report. ORION's record of each attempt and its verdict supports the incident register the law requires.

Is a Size Threshold on File Transfers a Reasonable Control?

Not for member data, as Desjardins found when the federal commissioner flagged its threshold for small transfers after the breach. ORION's verdict weighs what the file holds, so a small file of member records bound for a USB key is denied on the first copy.

Sources

Quotes from French-language sources are our translation.

• Décision 1020846-S, Fédération des caisses Desjardins du Québec. Commission d'accès à l'information du Québec, December 11, 2020.
• PIPEDA Findings #2020-005: Investigation into Desjardins' Compliance with PIPEDA Following a Breach of Personal Information Between 2017 and 2019. Office of the Privacy Commissioner of Canada, December 14, 2020.
• Décision n° 2020-PDG-0074. Autorité des marchés financiers, December 14, 2020.
• Desjardins Group Personal Data Leak: AMF Orders the Federation to Comply with Its Sound and Prudent Management Obligations. Autorité des marchés financiers, December 14, 2020.
• Evidence, Meeting No. 171, Standing Committee on Public Safety and National Security. House of Commons of Canada, July 15, 2019.
• Journal des débats de la Commission des finances publiques. Assemblée nationale du Québec, November 21, 2019.
• Desjardins Statement Concerning Unauthorized Access to Some Member Information. Desjardins Group, June 20, 2019.
• Desjardins Responds to the Report from the Office of the Privacy Commissioner of Canada and the Orders from the Commission d'accès à l'information du Québec and the Autorité des marchés financiers. Desjardins Group, December 14, 2020.
• Potential Scope of Desjardins Data Breach Widens to Include Another 2 Million Credit Card Holders. CBC News, December 10, 2019.
• Desjardins Group Says 2019 Theft of 4.2 Million Members' Data Cost $108 Million. Global News, February 2020.
• Jugement sur la demande pour approbation d'une entente de règlement, Boulay c. Fédération des caisses Desjardins du Québec. Superior Court of Québec, June 14, 2022.
• Vol de données chez Desjardins : la Cour approuve le règlement de 200 M$. Radio-Canada, June 17, 2022.
• Desjardins : les victimes de vol d'identité commencent à recevoir leurs indemnités. Radio-Canada, January 16, 2024.
• Vol d'identité chez Desjardins : jusqu'à octobre 2025 pour réclamer. Radio-Canada, August 7, 2025.
• Arrestations, projet Portier. Sûreté du Québec, June 2024.
• Les données de près de quatre millions de clients publiées. La Presse, November 1, 2025.
• Une fraude de 9 millions grâce à une liste de données volée à Desjardins. La Presse, January 20, 2026.
• In the Matter of Morgan Stanley Smith Barney LLC, Release No. 34-78021. U.S. Securities and Exchange Commission, June 8, 2016.
• Exfiltration Over Physical Medium: Exfiltration over USB (T1052.001). MITRE ATT&CK.
• Breach of Security Safeguards Regulations (SOR/2018-64). Justice Laws Website, Government of Canada.
• Act Respecting the Protection of Personal Information in the Private Sector (CQLR, c. P-39.1). LégisQuébec, Government of Québec.

‍