The police still have “at least” until June to complete their Portier Project on the massive data theft that occurred at Desjardins. Investigators will have been working on the largest information leak in Quebec for more than five years. Documents made public also reveal that a parallel investigation into identity thefts carried out with stolen personal information is underway.
“I am of the opinion that it will take me at least 12 months to complete all my obligations in order to complete the investigation,” explained Sergeant Catherine Gohier of the Sûreté du Québec last June, in a request recently made public to be able to keep seized property.
The police would therefore still have it until next summer.
The SQ says it is preparing its file to submit it to the Director of Criminal and Penal Prosecutions. His “statement of facts”, which is used to transmit information to prosecutors, was “75%” finished last June, according to his statements.
On December 5, Judge Mélanie Hébert of the Court of Quebec allowed the police to keep their potential evidence until August.
A sub-investigation into identity theft
Other documents made public also reveal that a “sub-investigation” is progressing in parallel with Portier: “Project D”. It concerns identity fraud carried out using information stolen from the Movement, between 2016 and 2019.
The lead investigator on this case, Kathleen Floyd, requested and received permission to preserve potential evidence seized in 2021 as part of this operation until July.
The police mention in particular a search involving Anis Rayane Bacha, a name which had still not been mentioned in the documents filed in court until now in connection with the theft of data. However, the heavy redaction of police statements prevents us from knowing more.
According to court records, Bacha, 25, must be tried in Salaberry-de-Valleyfield for unauthorized use of a computer and credit card, identity theft, use of false documents and forgery. These offenses allegedly occurred in 2019 and 2020.
The denunciation does not specify whether the case is linked to Desjardins data and his lawyer Ramy El-Turaby did not return a call. The Press to enlighten him on this subject.
11 topics of interest
In total, the main investigation, Portier, targets 11 people and 14 companies. Nine SQ police officers are working to bring the project to fruition. They met with 107 witnesses, including around twenty Desjardins employees.
Among the suspects are eight brokers, ex-brokers and private lenders from the Quebec and Montmagny regions, including Charles Bernier, Mathieu Joncas and François Baillargeon-Bouchard. They are suspected of having bought stolen data to resell it or “obtain a competitive advantage”, according to police statements filed in this case.
Among the suspects is also a certain Patrick Richard. For the first time, a less redacted version of a police statement reveals that this broker also “appropriated Desjardins customer lists” to “have a competitive advantage”.
3.85 million profiles from a fraudster
The information made public confirms the central role played by Juan Pablo Serrano and his roommate Maxime Paquette in the dissemination of the stolen data. The SQ conducted a successful search in their apartment on Terry-Fox Avenue in Laval in September 2019, with “dynamic entry” (the police broke down the door).
PHOTO FROM FACEBOOK
Juan Pablo Serrano
According to investigators, Serrano was one of the first to buy stolen data from Jean-Loup Leullier-Masse. This private lender allegedly acquired them from former Desjardins employee Sébastien Boulanger-Dorval, suspect number one.
According to the SQ statement, Serrano and Paquette had at home a file containing 3.85 million profiles of Movement members.
“Serrano sells lists of personal data from Desjardins to different subjects involved in the fraud,” said the investigator in the Portier file last June.
Court records reveal his extensive criminal past: fraud, theft, obstruction of a police investigation, offenses related to credit cards, etc.
The devices seized from Serrano allegedly contained tracking notes on 61 people who were victims of bank fraud and data theft, forwarding addresses to have fraudulent cards delivered and fake IDs.
The documents also mention an “alliance” between Serrano and an individual whose name is redacted, as well as “their discussions regarding Desjardins data.”
Contacted through his Telegram account, Serrano made no comment.
As for his roommate Maxime Paquette, mentioned both in the Portier investigation into data theft and in Project D on identity theft, the SQ noted in another statement that he “has a history of violence and offensive weapons.
Joined by The Presshis lawyer François Létourneau-Prézeau assures that he does not know what the police are referring to, adding that his client has neither “been found guilty” nor “pleaded guilty to an event of violence”.
Paquette’s lawyer recalls that his client “is presumed innocent.” “The case has been under investigation for years, no charges in these cases have been laid to date and we do not know if there will be any. »
Data was still circulating in June
Data stolen from Desjardins members was still circulating among criminals last June, according to police.
“Desjardins customer lists are still in circulation and misused, causing significant harm to several victims of this major identity theft,” notes the statement from investigator Gohier.
Joined by The Pressspokesperson Chantal Corbeil says that the Movement is aware that certain client lists “may still be in circulation”, but that this is “mainly outdated information”.
The story so far
June 2019
The Laval police, who began the investigation, searched the offices of Prêt Argent 500, the private loan company of Jean-Loup Leullier-Masse and Charles Bernier in Montmagny. Desjardins announces that it has been the victim of a large data leak, claiming at that time that 2.9 million customers are affected.
The media quickly identified certain suspects, such as ex-employee Sébastien Boulanger-Dorval and fraudster Juan Pablo Serrano.
September 2019
Search at the homes of Juan Pablo Serrano and Maxime Paquette, in Laval.
October 2019
The media reveal that a group of brokers from the Quebec and Montmagny regions are suspected of having bought the data to promote their business.
November 2019
Desjardins announces that ultimately, 4.2 million people had their information stolen.
December 2020
The Commission d’access à l’information du Québec and the Office of the Privacy Commissioner of Canada publish the conclusions of their joint investigation. It reveals that the data of 9.7 million people may have been compromised on Desjardins servers.
February 2021
The SQ spent several days searching the Montreal offices of Desjardins to gather evidence.