More than five years after massive leaks of personal information at Desjardins, the Sûreté du Québec (SQ) announced Thursday the arrest of the main suspect in this affair, Sébastien Boulanger-Dorval, aged 42, who worked in the marketing department of the cooperative until 2019.
Three other suspects were arrested, the SQ announced Thursday. They are Jean-Loup Masse-Leullier, 32 years old, François Baillargeon-Bouchard, 35 years old, and Laurence Bernier, 29 years old.
They face charges including fraud, identity theft and trafficking in identifying information.
These arrests, as part of the Portier investigation, are linked to “the theft and resale of personal information of the 9.7 million members and clients of Desjardins Group”.
“Begun in June 2019, the Portier project aimed to trace individuals who stole, used and distributed lists of personal data for fraudulent purposes,” we can read in the SQ press release.
Four suspects have not yet been located. Arrest warrants have been issued against them.
On Wednesday, the Laval Police Service (SPL) announced the arrest of three other suspects also linked to this data theft.
Two damning reports
In December 2020, two damning reports about the data leak that affected more than 9.7 million people in Canada and abroad in 2019, including nearly 7 million Quebecers, concluded that Desjardins had not complied with several obligations imposed on it by the Act respecting the protection of personal information in the private sector.
The report from the Commission for Access to Information of Quebec underlined that the cooperative had “failed in its obligation to limit access to personal information, in particular that which is saved in shared directories”.
Sébastien Boulanger-Dorval, who is at the origin of the leak, worked within the marketing team at Desjardins head office.
He had access to personal information that his access rights to the databases did not allow him to obtain, underlined the report of the Commission for Access to Information.
Contrary to the directives, this confidential information was located in directories shared by all employees of the marketing team.