4.2 million Desjardins members affected by data breach, credit union now says

Desjardins Group says the theft of member data announced in June is far larger than initially thought,affecting all 4.2 million individual members of the credit union.

The organization initially said the breach affectedaround 2.7 million people and173,000 businesses,more than 40per cent of the co-operative's clients and members.

"We're not announcinga new breach,"Guy Cormier, president and CEO of Desjardins Group, said Friday at a news conference in Montreal. "This is an update on the same breach perpetrated by a malicious employee."

The credit union said the Sretdu Qubec(SQ), Quebec's provincial police force, had informed them a day earlier that the number affected had grown to 4.2 million "individual members" in Quebec and Ontario. This is the entirety of Desjardins'personal-banking clientele, the organization confirmed.

"There is no information at this time about whether or not more business members have been affected," Desjardinssaidin a statement.

There is still only a single suspect, the statement said, citing information shared by the SQ. No one has been charged.

The list of personal information leaked included names, addresses, birthdates, social insurance numbers, email addresses and information about transaction habits.

"As we said in June, passwords, identification questions and secret codes were not compromised by the data breach," Cormier said.

Desjardins is offering membersa five-year credit monitoring service from Equifax, paid for by the co-op.

Cormier saidthere has not been a spike in fraud cases, eitherbefore or after theprivacy breach was first announcedon June 20.

"Since the privacy breach was first announced, we'vemade itclearthat we intendedto enhancethe Desjardins identity protection service," he said.

Quebec opposition parties renew call for action

When the breach was announced in June, Quebec's opposition parties called for a commission to look into banking practices and personal information in the province. At the time, Quebec Premier Franois Legault saidhe had faith in Desjardins' management to deal with the issue.

With the impact of the breach now much broader than originally thought, QubecSolidaire MNAVincent Marissalnoted in a statement Friday thatthe Legault government's praise of Desjardins' crisis management came while"millions of members were unaware that the leak was affecting them."

In a separate statement, Martin Ouellet, the Parti Qubecois finance critic, called it "an exceptional situation" with more than half the province now affected.

"The CAQ government mustreconsider its decision and move quickly with the establishment of a parliamentary commission to deal with this issue, as we have already repeatedly demanded," hesaid.

At a news conference Friday afternoon, Quebec Finance Minister ric Girardacknowledged that "it would have been preferable if there was no data stolen and if it had been detected earlier."

But he said Desjardins' response was satisfactory.

"What's most important for Quebecers is that their assets are protected," he said. "There's prevention of fraud,andin the case of identity theft, there will be significant help. It means [Desjardins] are dealing with the situation adequately."

Revised numbers came after September warrants

In an update on the investigation in September, the SQ saidit was questioning 17 people in connection with the data breach.At the time, SQ Sgt. Claude Denissaid the interrogations followed the execution of six search warrantsat four residences and two businesses in Laval, Que., Montreal and Quebec City.

Most of the people the SQ spoke with hadtried to acquire the breached data, or parts of it,Denis said

Desjardinsis the largest federation of credit unions in North America, with outlets across Quebec and Ontario.