SQ arrest 5 more in Desjardins data breach, more sought

The Sûreté du Québec arrested five more suspects Thursday connected to the massive 2019 Desjardins data breach – that affected 9.7 million clients.

Sébastien Boulanger-Dorval, 42, Jean-Loup Masse-Leullier 32, François Baillargeon Bouchard, 35 and Laurence Bernier, 29, were arrested by members of the SQ’s Economic Crimes Investigation Department. and by afternoon, Charles Bernier, 31, had also been arrested.

The suspects face accusations that including fraud, identity theft and information trafficking identifiers. 

These arrests were part of what the SQ are calling their ‘Portier’ project that targets individuals involved in data theft.

The SQ is also looking for Mathieu Joncas, 38. They believe he could be out of the country. An arrest warrant was issued.

Two more suspects, Maxime Paquette, 38, and Juan Pablo Serrano, 38, have Canada-wide arrest warrants issued against. The SQ say both are on the run and considered to be among the most serious criminals sought in Quebec.

Thursday’s arrests follow three arrests made on Wednesday linked to the breach. Imad Jbara, 33, Ayoub Kourdal, 36, and a third suspect were arrested by Laval police in this case. 

These suspects face charges of identity theft, possession of identifying information, trafficking in identifying information and fraud over $5,000.

Laval police said that these individuals allegedly participated in fraud totaling $8.9 million between September 2018 and January 2019.

And they are also looking for a fourth suspect.

A $200-million class-action lawsuit related to the breach was approved by the Quebec Superior Court of Quebec in 2022.

While the arrests and warrants are significant, they may not be a deterrent says one expert.

“The sad fact for most of us is that cyber crime is incredibly profitable. It’s relatively easy,” said Carmi Levy, a technology analyst. “The tools for cyber criminals to engage in activity like this are becoming easier to use, more powerful, more affordable, more accessible, almost by the day.”

Despite the major developments in this case, some Desjardins customers we spoke to still have concerns about the security of their personal data.

“They say, oh, we’re going to protect you, I have the impression, after all, that the biggest problem is all the information they ask us in order to protect us,” said Steve, a Desjardins client. “This is exactly what is the big problem is they end up having too much information about us. So that’s what I’m scared of.”

“It’s concerning for sure. I hope that they’re going to, you know, look into that and things will get sorted out because I think that this has been a bank that’s been along for a long time,” said Ana Zandi, a Desjardins client, adding, “and the value is the confidence of the customer. So they really need to do something about that. And like I said, bring up their game on that because I feel like they’re slowly, the confidence going down.” 

“Yeah, I feel confident with Desjardins still,” said Laurent Ethier, another Desjardins client. “I think this could happen to every bank, so I don’t really think it’s something scary, and they did measures to protect our data.” 

“Law enforcement agencies, financial institutions, regulators, government agencies, they’re looking very closely at what’s happening now with the Desjardins case so that they can learn for future to keep us all better protected and introduce better laws that minimize the risks for all of us,” said Levy.