In 2019, one of the largest credit union federations in North America announced something every organization fears: a trusted insider had taken customer data and shared it. The Desjardins Group, based in Quebec, said that an employee had improperly accessed and disclosed personal information on a very large number of members and on businesses. Early reporting cited about 2.7 million individuals and around 173,000 businesses. Later updates raised the totals. The case is old enough to be a retrospective now, but its lessons are still current, because insider leaks, social engineering and doxxing remain common. This article explains what happened in broad terms, why insider incidents are different, what the exposure of this kind of data means and how to protect yourself after any breach. For the basics, see what is a data breach.
1. What happened
Based on public statements and news coverage at the time, the incident involved an employee who obtained access to member records beyond what was appropriate and shared them with third parties. The exposed information was reported to include names, addresses, dates of birth, social insurance numbers, email addresses and details about transaction habits. The company notified members, offered protective measures and cooperated with investigators. Police later arrested a person in connection with the incident. Because details of investigations and figures were updated over time, treat specific numbers as reported at the time and check official sources for the final tally.
We are describing the case as a general lesson, not accusing any individual beyond what has been established publicly.
2. Why insider incidents are different
Most security discussions focus on outside attackers: hackers who break in through technical flaws. Insider incidents bypass those defenses because the person already has legitimate access. They come in several forms.
- Malicious insiders. People who deliberately steal or leak data for money, revenge or ideology.
- Negligent insiders. People who make mistakes, such as sending files to the wrong recipient or leaving systems exposed.
- Compromised insiders. People whose credentials are stolen or who are tricked by social engineering.
In reported accounts of the Desjardins case, the insider reportedly exploited trust and access within the organization. The broader lesson is that organizations must limit access to what employees need, log and review unusual activity and treat large exports as events worth investigating.
3. What doxxing means in this context
Doxxing is the deliberate publication of someone’s private information, usually to enable harassment, fraud or intimidation. The term has been associated mostly with individuals targeted by online mobs, but large-scale leaks are also called doxxing when personal records are released publicly. When millions of people’s data is exposed at once, it becomes available to criminals who can combine it with other sources. Our article on how doxxing can happen to anyone explains the individual version.
Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.
4. Why leaked data stays dangerous
An arrest does not undo a leak. Once data has been copied, it can be shared, sold and combined with other leaked data. Criminals do not need to act immediately; they can wait months or years. The impact of leaked data lingers, as explained in how long data leaks can affect you.
The type of data matters. Names and addresses are bad. Birth dates and national identification numbers are worse because they are hard to change. In the United States the equivalent identifier is the Social Security number, and the FBI’s Internet Crime Complaint Center received 31,675 identity theft complaints in 2025, with reported losses of $185.8 million (ic3.gov). It also received 67,456 personal data breach complaints, with reported losses of $1.31 billion. These numbers show why breach exposure is not an abstract concern.
5. What breached organizations typically do
After an incident, organizations commonly notify affected people, offer credit monitoring, report to regulators and review security. The quality of response varies. Our article on how companies respond to data breaches discusses patterns, and data breach response strategies offers a plan for individuals.
Credit monitoring is helpful, but it is reactive. It alerts you after something happens. A credit freeze is preventive. Use both if the data exposed includes identifiers like birth dates and national ID numbers.
6. What to do if your data was in a breach
Read the notice carefully
Identify what was exposed. Names and emails call for different steps than ID numbers or financial data.
Freeze your credit
A freeze blocks new credit accounts. In the United States you can place freezes with each bureau for free. See what is a credit freeze.
Change passwords and enable two-factor authentication
Start with email and financial accounts. Use unique passwords and an authenticator app or passkey.
Watch your accounts and reports
Review statements and credit reports. Report fraud and follow recovery steps at identitytheft.gov.
Be alert to targeted scams
Breach victims are targeted by messages referencing the incident. Verify any contact using official channels, and report scams at reportfraud.ftc.gov.
Reduce public exposure
Leaked data is often combined with broker profiles. Remove people-search listings so criminals have fewer facts to pair with the leak. Verified opt-out pages include Spokeo, the PeopleConnect suppression center and That’s Them.
7. For organizations: lessons from insider cases
Although this guide is written for individuals, the case offers lessons for any organization that holds personal data.
- Grant access on a least-privilege basis.
- Log access to sensitive records and review anomalies.
- Alert on bulk exports.
- Train staff to recognize social engineering.
- Separate duties for sensitive functions.
- Plan for communication and response before an incident.
8. Timeline: responding to a breach
| When | Action |
|---|---|
| Day 1 | Read the notice, change passwords, enable two-factor authentication |
| Day 2 | Freeze credit and set fraud alerts |
| Week 1 | Review statements and reports, start broker removals |
| Month 1 | Re-check reports, watch for targeted scams |
| Ongoing | Keep the freeze, review reports annually |
9. Why financial institutions are such attractive targets
Banks and credit unions hold the data criminals value most: verified names, addresses, birth dates, account histories and national identifiers. A single member file can be enough to open credit, take over an account or craft a convincing impersonation call. That concentration of value is why financial institutions invest heavily in security and why insider access controls get so much attention. For you as a customer, the practical consequence is that you cannot assume a financial institution’s size ensures safety. Assume some of your data will be exposed at some point, and prepare accordingly with a freeze, strong authentication and a habit of reviewing statements.
10. International lessons for people who are not Canadian
The Desjardins case involved Canadian members, but the pattern applies everywhere. In the United States, the equivalent exposures involve Social Security numbers, driver’s license numbers and bank account details. In Europe, regulators treat breaches under data protection law with mandatory notification. Whatever your country, the same defensive steps apply: reduce what is public, lock down credit, use unique passwords and respond quickly to notices. Criminals do not respect borders, and leaked data often crosses them within days.
11. How to spot follow-on fraud
After a major leak, expect a wave of follow-on attempts. Common patterns include emails and texts that mention the breach and offer “free protection” through a link, calls that claim to be from the institution’s fraud department and ask you to confirm details, and fake letters that look official. A legitimate organization will not ask for your password or full ID number by phone, and it will not pressure you to act within minutes. When in doubt, hang up and call the number on your card or statement. If you think you have been scammed, report it at reportfraud.ftc.gov and file internet crime reports at ic3.gov.
12. Questions to ask your own bank
You can lower your risk by asking your financial institutions a few direct questions. Do you offer app-based two-factor authentication or passkeys? Can I set alerts for large transactions and profile changes? Do you require extra verification for changes to my contact information? How do you limit employee access to my records? Their answers will tell you how seriously they treat insider risk, and the act of asking encourages institutions to improve.
13. Three scenarios and what to do
Scenario 1: You receive a breach notice with an ID number exposed. Freeze credit immediately, consider fraud alerts and monitor reports.
Scenario 2: A caller references the breach. Hang up. Call the organization using a number you find independently.
Scenario 3: Your data appears on a leak forum. Do not engage. Document, report to authorities and strengthen account security.
14. Myths and facts
| Myth | Fact |
|---|---|
| An arrest ends the risk | Copied data can still circulate |
| Only hackers cause breaches | Insiders do too |
| Breaches only matter in the country where they happened | Data and criminals cross borders |
| Credit monitoring is enough | A freeze prevents new accounts |
| Nothing can be done | Reducing exposure helps |
15. Common mistakes
- Ignoring the notice.
- Clicking links in unexpected breach emails.
- Reusing passwords.
- Not freezing credit.
- Leaving broker listings that match the leaked data.
16. Questions to ask yourself
Which of my identifiers are hardest to change? Do I know which companies hold them? Have I frozen my credit? Do I have two-factor authentication on key accounts? Preparing before a breach makes the response faster.
17. How Wiperts fits
Breach data and broker data work together in the hands of criminals. Wiperts reduces the broker side: it scans more than 100 data brokers and people-search sites, submits removal requests, removes personal results from Google and Bing, blurs your home on maps and monitors for returning profiles. Start with the free diagnosis.
100% Free Diagnosis: Check Your Exposure
Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:
- First Name
- Last Name
- Select State
- Email Address
- Website
Scan Databases Now — no payment is needed to see your exposure report.
18. Key takeaways
- The 2019 Desjardins case shows how insiders can expose data on millions of people.
- Leaked data stays dangerous after arrests because copies persist.
- After a breach, freeze credit, secure accounts, watch for scams and report fraud.
- Reduce public exposure so leaked data has less to combine with.
Pick the Wiperts plan that fits your household
| Plan | Covers | One-time deep scrub | Then |
|---|---|---|---|
| Individual | 1 person | $89 | $14/month |
| Couples (most popular) | 2 people | $149 | $24/month |
| Family | Up to 4 people | $199 | $39/month |
Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal
19. Frequently Asked Questions
What happened in the Desjardins data leak?
In 2019 Desjardins disclosed that an employee had accessed and shared member and business data without authorization. Early reports cited about 2.7 million individuals and about 173,000 businesses, and later updates increased the totals.
What is doxxing?
Doxxing is deliberately publishing someone’s private personal information online, often to harass them or enable fraud.
Why are insider breaches hard to stop?
Insiders already have access, so perimeter defenses do not stop them. Companies rely on access limits, monitoring and strong internal controls.
If the person was arrested, is my data safe?
Not necessarily. Once data has been copied or shared, arrests do not mean it has been recovered or that it will not be misused.
What should I do if my data was in a breach?
Freeze credit, change passwords, enable two-factor authentication, watch accounts and statements and report identity theft at identitytheft.gov.
Can I remove leaked information from the web?
You can remove listings from people-search sites and request search result removal where eligible, but you cannot always erase copies in circulation.
Sources
Related Reading
- What Is a Data Breach? Causes, Risks and What To Do
- Data Breach Response Planner: What to Do in the First 30 Days
- Doxxing Can Happen to Anyone: How to Prevent It and What to Do
- How Long Can Data Leaks Affect You?
- Why Data Leaks Keep Fueling Identity Fraud
- Data Breach? Don’t Panic: How to Scrub Your Exposure Afterward
- An Inefficient Cycle: How Companies Respond to Data Breaches
- The 3 Biggest Data Breaches: Yahoo, Equifax and Capital One
Ready to erase your footprint?
Stop letting data brokers profit from your personal life. Start your removal today.
Start Removing