The information of 2.9 million Caisse Desjardins members, including 173,000 businesses, has been shared with people outside the organization, Desjardins Group announced Thursday.
The data breach, discovered by Laval police on June 14, affected 41 per cent of the members the Quebec-based co-operative — the largest federation of credit unions in North America.
The information includes names, addresses, birth dates, social insurance numbers, email addresses and information about transaction habits. However, Desjardins said, passwords, security questions and personal identification numbers have not been compromised.
The federation’s CEO and president, Guy Cormier, said the security breach is not the result of a cyberattack, but the work of an employee who improperly accessed and shared the information.
That employee has been fired. He was arrested by Laval police but has not yet been charged.
Cormier said he felt “betrayed” by the former employee’s actions.
“I won’t say all the words that I have in mind at the moment, because I know I’m in front of television cameras,” Cormier said at a news conference in Montreal.
“It’s a situation we deeply regret,” he said.
Quebec’s regulator of financial institutions, the Autorités des marchés financiers (AMF), described the situation as “very serious” but said it is “satisfied with the actions” taken so far by Desjardins Group.
“The institution’s officers have handled the situation with due rigour, transparency and speed,” AMF said in a news release.
The Desjardins Group said additional security measures have been put in place to protect data, and it will be contacting every member affected by the leak individually.
Anyone whose data was affected will receive a 12-month credit monitoring plan, paid for by Desjardins. That service includes access to daily credit reports, alerts of any changes and identity theft insurance.
“I want to be really clear,” said Cormier. “Our members will be reimbursed [for any losses they incur.] There will be no cost to our members.”
Desjardins Group’s chief operating officer, Denis Berthiaume, said he cannot yet put a dollar figure on the financial loss to the co-operative.