Desjardins is Quebec’s cooperative bank. Canada’s largest credit union. An institution that markets itself as community owned, member first, and rooted in the specific Quebec cooperative tradition that distinguishes it from the large corporate banks. The institution that many Quebec residents are told to trust because it is ours. Between October 2016 and May 2019 a Desjardins employee named Sébastien Boulanger-Dorval systematically stole the personal information of millions of Desjardins members and clients. He sold it on darknet markets and cybercrime forums. For 26 months. Before Desjardins knew it was happening. Desjardins did not discover the breach through its own security systems. It was notified by police. The data stolen included names, dates of birth, social insurance numbers, residential addresses, telephone numbers, email addresses, transaction histories and banking habits. For nearly 10 million individuals. How This Was Possible for 26 Months The federal Privacy Commissioner’s investigation found that the breach was the result of a series of technological and administrative gaps at Desjardins. The malicious employee had access to a shared marketing data warehouse containing sensitive member information. That access was not adequately monitored. The exfiltration of data over 26 months did not trigger the security alerts that should have detected unusual activity. Which means Desjardins had the personal financial data of nearly 10 million Canadians in a system that one marketing department employee could access, copy, and sell for over two years without the institution noticing. The federal Privacy Commissioner and Quebec’s Commission d’accès à l’information both concluded that Desjardins failed to show the required level of attention to protect customer data. Not a sophisticated external attack. An internal employee. With standard access. For 26 months. Before police told them it was happening. What the Customers Received Desjardins settled the resulting class action lawsuit for $200.9 million. The largest class action settlement in Canadian financial services history at the time. Customers who filed a claim received up to $90 for lost time. Customers who experienced identity theft could claim up to $1,000. Which means a customer whose social insurance number, home address, banking history and personal details were sold on darknet markets for up to two years was offered a maximum of $1,000 if they could document the resulting identity theft. One customer who went through the claims process documented receiving $88 for their Subclass 1 claim. Then received a request for documentation they would have to pay to obtain. They noted that the documentation would cost more than the $88 settlement payment. $201 million divided across 9.7 million affected individuals produces approximately $20 per person on average. Before legal fees which Desjardins covered separately. The Desjardins president said at the time that the financial impact of the breach represented less than one percent of the institution’s $18 billion in annual revenue and that Desjardins had ample capacity to absorb it. Which is accurate. For Desjardins. For the customer whose social insurance number was sold on a darknet forum the capacity to absorb the consequences was different. The Cooperative That Forgot Its Members Desjardins markets its cooperative structure as a fundamental distinction from corporate banking. Members are owners. The institution exists to serve them. The cooperative model is supposed to produce a different relationship between the financial institution and the people who trust it with their money and their data. The cooperative model did not prevent a 26 month internal data theft affecting nearly 10 million members. It did not produce security infrastructure adequate to detect an employee copying and selling member data. It did not result in compensation meaningful enough to address the identity theft consequences that members experienced. What the cooperative model produced was a settlement that the institution described as representing less than one percent of annual revenue. Which the institution’s president described as within ample capacity to absorb. The members whose data was sold absorbed something different. The Quebec Institutional Pattern This platform has documented a consistent pattern across Quebec institutions in recent weeks. Public money and member trust flow into institutions. Those institutions make decisions that harm the people they serve. The consequences fall on those people. The institutions absorb the financial cost within their operating margins and continue. The taxi drivers whose permits were devalued received inadequate compensation confirmed by the Court of Appeal. The nurses driven from the public system by poor working conditions are replaced at premium agency rates while the shortage continues. The school bus operators given a monopoly supplier watched the buses catch fire and the company go bankrupt while their routes were cancelled. The REM passengers who lost their bus alternatives had no transit during system shutdowns. The Desjardins members whose data was sold for 26 months received $88 and a request for documentation. The cooperative that is supposedly owned by its members did not protect the most sensitive data those members trusted it with. When held accountable through the legal system it settled for an amount its CEO described as easily absorbable. The members absorbed what the institution could not feel. The Honest Note for Anyone Opening a Business Account Desjardins is still the recommended option for Quebec small business banking given its cooperative structure, accessible fees, and local presence. The breach was a serious institutional failure that produced real harm. It also resulted in the largest financial services class action settlement in Canadian history and significant security improvements that followed. The institution is not uniquely malicious. It is a large institution that failed at data security in ways that large institutions fail regularly across every country. What makes the Desjardins case specific to this platform’s documentation of Quebec institutions is the gap between what the institution markets itself as and what it delivered when the gap between marketing and reality became visible. Member first. Cooperative. Community owned. $88 per affected member. SIIIOCULI — Intelligence. Sovereignty. Awareness. siiioculi.lilxbrxaker.com