Massive data theft at Desjardins | The evidence released, the investigation can move forward

The Portier project of the Sûreté du Québec on the massive theft of data at Desjardins will finally be able to move forward more smoothly. More than two years after a search of the Movement’s offices, the police finally have access to the evidence they seized there, after a long process to determine what should remain confidential. Prosecutors will not file charges until the fall, however, according to our information.

Nearly four years after Desjardins announced the gigantic leak of information, no one has yet been charged. The former employee of the Movement Sébastien Boulanger-Dorval is suspected of having got his hands on the data and of having transmitted them to the businessman Jean-Loup Leullier-Masse, who then sold them to a group of Quebec brokers.

Charges could be filed by the end of the year, according to a source with knowledge of the investigation, who does not have authorization to speak about it. The leak claimed some nine million victims.

The Sûreté du Québec (SQ) declined to give further details. “We are continuing our investigation, but we are not commenting on it,” said Benoît Richard, spokesperson. If necessary, we will submit our case to the Director of Criminal and Penal Prosecutions. »

Desjardins is delighted with this development, said spokesperson Chantal Corbeil. “All we want is the same thing as the police: that the case progress and that charges be laid. »

Four days of search

In February 2021, the SQ raided the Movement’s offices at Complexe Desjardins and Peel Street in Montreal for four days. The police had however taken care to present at the same time a request “Lavallée”. This procedure provides that an amicus curiae (friend of the court) – an independent lawyer – decides between what the authorities can use in evidence, and what must remain confidential by virtue in particular of the lawyer-client privilege.

It is this work that ended on Thursday. Initially, the SQ estimated the time required at six months. In the end, it took four times as long to review the evidence.

“Considering the complexity of the request and the sometimes divergent interests of the parties, we are already blocked quite early in the application of the protocol”, lamented the prosecutor Richard Rougeau in the Superior Court, in April 2021.

At the time, discussions between the Department and Desjardins were bogged down over the choice of the friend of the court who would be responsible for separating the divulgable evidence from the privileged elements.

Lawyers for the Crown and those for Desjardins took five months to agree on the right way to proceed. Then, numerous legal and technological considerations slowed down the police investigation into this massive data breach.

The lawyers then set up a room under high security in the premises of the Movement.

Specialists from the SQ’s technology division had to examine millions of files. They worked under the close supervision of Desjardins lawyers, then of security guards.

Their “fully secure” computers were disconnected from any network, to prevent any information leakage. In her report, friend of the court Solanie Ann Picard Turcot explains that the devices could only accommodate “USB keys or external hard drives with a specific configuration that only the Desjardins computer security team can install or modify” .

His account gives an idea of ​​the complexity of the process. For example, in February 2022, the lawyers fell on a bone when they wanted to process a mass of documents in “spreadsheet” format. “Files with an .XML extension number more than four million and their processing […] presents substantial difficulties”, recounts in her report the friend of the court.

A (too?) early entry

In addition to Desjardins, the main suspect also had to agree to release certain seized evidence. Desjardins had seized the computer equipment that Boulanger-Dorval used at his office at the head office in Lévis and at his residence. The Movement had obtained permission under an Anton Piller order, a civil procedure that allowed it to seize equipment from its employee.

The Laval police, who began the investigation after receiving the first complaints, had also warned the Movement against the danger of carrying out this collection of evidence itself, in May 2019. Detective Patrick French then told them repeated not to act without police approval, “in order not to harm the ongoing investigation”, according to a statement drafted to obtain a search warrant.

Desjardins went ahead anyway and his employee was “informed” of the operation. Boulanger-Dorval was then able to make information disappear, as reported The Press in October 2021.

Movement spokeswoman Chantal Corbeil explained that the financial institution wanted to “put an end to this scheme as quickly as possible” to stop the damage.

Police documents have confirmed that a group of mortgage and insurance brokers in Quebec are suspected of having got their hands on the data. Several of them have also been condemned by their disciplinary councils. This is the case of Mathieu Joncas, a mortgage broker and private lender sentenced to a $36,000 fine and 420 days of suspension for having purchased lists of data on Desjardins clients.

His partner, insurance broker François Baillargeon-Bouchard, was fined $40,000 for acquiring client lists and “attempting to obstruct the duties of a representative of the Autorité des marchés financial”.

The police are also interested in his former employee, Nicolas Fecteau-Tincau, a mixed martial arts fan who lost his insurance broker’s license in October 2022 because of his criminal record.