Final suspect in Desjardins data breach case arrested in Mexico: SQ
Posted July 16, 2026 12:13 pm.
Last Updated July 16, 2026 2:02 pm.
Sûreté du Québec (SQ) says the final suspect in the case of a multimillion-dollar fraud and data theft of Desjardins customers was arrested in Mexico.
Maxime Paquette, who was one of the Quebec’s most-wanted fugitives, was arrested in Cancun during an operation involving the Mexican Navy and the Mexican Criminal Investigation Agency.
The 40-year-old will remain in the custody of law enforcement officials in Mexico while the extradition process to bring him to Canada goes on. He faces several charges, including fraud of over $5,000, identity theft and trafficking of identities.
A massive Desjardins data breach in 2019 affected 9.7 million clients. Police have said suspects obtained personal information, which was then sold to “malicious individuals operating several fraud schemes.”
Paquette’s arrest came after a more than two-year manhunt involving Mexican authorities, the RCMP and the Interpol, among others.
Several suspects were arrested in 2024 as part of the SQ’s “Portier” investigation, including the alleged architect of the scheme — a man who worked in the marketing department at the financial institution.
Paquette and Juan Pablo Serrano were the final two suspects on the run. In November 2025, Serrano was arrested in Spain.
Police allege that Paquette carried out various fraud schemes using Desjardins member and customer data obtained from lists acquired through illegal means between March 2018 and September 2020.
In 2021, he was also allegedly found with confidential information of Desjardins customers exposed in the 2019 breach.
“He also sold identifying information from the stolen Desjardins lists to several individuals and on the ‘Dark Web,’ the SQ said.
The Office of the Privacy Commissioner of Canada (OPC) and the Commission d’accès à l’information du Québec published scathing reports in 2020 that concluded Desjardins failed to show the level of attention required to protect its customers’ data.
The OPC report said Desjardins notified the federal office on May 27, 2019, about a breach involving close to 9.7 million individuals in Canada and internationally. It found that Desjardins had been aware of the security weaknesses that led to the breach, but failed to address them in time.
The breach occurred “over more than a two-year period before Desjardins became aware of it, and then only after the organization had been notified by the police,” the report said.
In a separate investigation into the use of stolen data, Laval police are still looking for another suspect Nassim Alikacem.
