Laval police arrested three individuals who allegedly participated in fraud totaling $8.9 million using data stolen from Desjardins, from September 2018 to January 2019. A fourth is wanted, following an investigation called “Project Glaive “.
Ayoub Kourdal, 36, Imad Jbara, 33, and Nassim Alikacem, 30, are accused of fraud over $5,000, trafficking in identifying information, possession of identifying information and identity theft. The first two were due to appear on Wednesday.
An arrest warrant was issued to arrest Alikacem.
PHOTO PROVIDED BY THE LAVAL POLICE SERVICE
Ayoub Kourdal
PHOTO PROVIDED BY THE LAVAL POLICE SERVICE
Imad Jbara
El Mehdi Ahlafi, 36, was released on a promise to appear. According to the information concerning him, he faces lesser charges of possessing identifying information for the purpose of committing fraud.
The accused come from Pierrefonds, Longueuil (Saint-Hubert), Quebec and Saint-Augustin-de-Desmaures, just west of the capital.
The investigation did not make it possible to recover any embezzled sums. Laval police mention that one of the suspects was in possession of “a list of 1.6 million Quebecers”.
Fraud by AccèsD
According to the alleged scheme, the suspects used data stolen from Desjardins to change passwords and access accounts through the AccèsD online platform. Once authenticated, they were able to “fraudulently appropriate funds,” explains Jean-François Rousselle, deputy director of criminal investigations, who led the press conference.
They could then have “dispersed the funds in Canada, the United States and around the world”.
As part of the operation, investigators carried out seven searches not only in Laval, but also in Montreal and Saint-Augustin-de-Desmaures, in the western suburbs of Quebec. The police thus got their hands on 70 different “computer items”.
The mass of data to be analyzed also explains why this development occurs more than five years after the start of the investigation, in January 2019. “Seventy devices, that’s an incredible pile of data to digest,” underlines Jean -François Rousselle.
“Fraud files resulted in a complex, large-scale investigation, which required the involvement of the Sûreté du Québec and the Serious Crime and Special Affairs Bureau of the Director of Criminal and Penal Prosecutions,” adds the police officer.
The main investigation into the theft of data at Desjardins itself was mainly carried out by the Sûreté du Québec (SQ) from June 2019. However, it began at the Laval police, after bank draft fraud carried out thanks to to information stolen from Desjardins, starting in December 2018.
Laval investigators continued the operation focusing on the network of fraudsters who were the subject of Wednesday’s arrests. The names revealed Wednesday had never filtered through court documents related to the data theft investigations until now.
The arrests come almost five years after the revelation of the massive data theft at Desjardins. Until Laval’s announcement, no criminal charges had yet been filed.
On June 20, 2019, the Movement first announced that data on 2.9 million customers had been stolen. He then revised this figure upwards several times.
In December 2020, the personal information protection commissions submitted damning reports on the management of confidential information within the financial institution. According to their findings, the theft potentially affected 9.7 million individuals and businesses.
A former Desjardins employee, Sébastien Boulanger-Dorval, is suspected of having himself got his hands on data concerning millions of Desjardins customers. A private lender, Jean-Loup Leullier-Masse, then bought them back, before passing them on to other suspects.
A Laval resident in the main investigation
The SQ’s main investigation into data theft, the “Portier” project, is particularly interested in a repeat fraudster from Laval, Juan Pablo Serrano, according to police statements filed in court.
In September 2019, the police seized a computer from his home containing no less than 3.85 million lines of data on Desjardins customers.
The SQ is also investigating a group of brokers from Quebec.
None have been charged, but some have had to answer for their actions before their profession’s watchdog. This is the case of Mathieu Joncas, a mortgage broker sentenced in 2022 to fines of $36,000 and 420 days of suspension. He admitted to having acquired information on “150,000 to 200,000” Desjardins customers.
His partner and insurance broker François Baillargeon-Bouchard, for his part, received fines totaling $40,000 for the repurchase of data on 40,000 customers and the obstruction of an investigation by the Financial Markets Authority.
Search at Desjardins
In February 2021, the SQ spent several days searching Desjardins offices to recover evidence gathered during its internal investigation into data theft.
Due to attorney-client privilege and the confidentiality of his clients’ data, the police had to wait almost two years before obtaining access to the evidence collected on this occasion.
Data theft at Desjardins, in dates
- November 2016 – The main suspect in the Sûreté du Québec (SQ) Portier investigation and Desjardins employee, Sébastien Boulanger-Dorval, begins to “illegitimately appropriate” data on customers, according to police documents filed in class.
- Fall 2018 – Desjardins becomes aware of fraudulent withdrawals and files a complaint with the Laval police.
- May 2019 – Desjardins carries out initial searches at Sébastien Boulanger-Dorval’s office and meets him.
- June 6, 2019 – Laval police conduct searches in Montmagny, in Chaudière-Appalaches, in the offices and residence of private lender Jean-Loup Leullier-Masse, now suspected of having recovered stolen data.
- June 20, 2019 – Desjardins announces that it has suffered a data theft, specifying at that time that it affected 2.9 million customers, a figure that will increase several times. The SQ takes charge of the investigation.
- December 2020 – In a damning joint report for Desjardins, the Commission d’access à l’information du Québec and the Office of the Privacy Commissioner of Canada estimate the number of people and businesses potentially affected at 9.7 million .
- February 2021 – The SQ conducts a four-day search of Desjardins offices to recover evidence that the Movement collected from its employee Boulanger-Dorval.
- June 2022 – The Superior Court of Quebec ratifies a 200 million agreement between Desjardins and the victims of data theft.