5 more arrests, including primary suspect, in connection with Desjardins data leak

Quebec provincial police have arrested five more people with crimes tied to a massive data breach at Desjardins, including the former bank employee originally suspected of being behind the leak.

Four of them, three men and one woman, were arrested early Thursday morning, hours after Laval police announced arrests of their own tied to the case. Another man, Charles Bernier, turned himself into police later in the day.  

They were charged with fraud, identity theft and the illegal possession and sale of personal information. One of the five, Sébastien Boulanger-Dorval, 42, was also charged with using a computer for fraud. 

Boulanger-Dorval was the primary suspect in the leak. He worked at Desjardins on a marketing team at the time of the leak and allegedly justified selling the leaked data to pay debts.

In addition to Bernier and Boulanger-Dorval, police arrested Jean-Loup Masse-Leullier, Laurence Bernier and François Baillargeon-Bouchard. Arrest warrants were also issued for three other people: Maxime Paquette and Pablo Serrano, who police believe are hiding abroad, and Mathieu Joncas. 

The charges against those arrested on Thursday allege they committed their crimes between Oct. 1, 2016, and May 27, 2019.

The Desjardins data leak was only revealed to the public in 2019 and the authorities only became aware in December 2018 when a suspicious transaction told them something was amiss.

Benoit Richard, the co-ordinator of broadcasting and media relations with the Sûreté du Québec, said it took years for investigators to make arrests because the investigation was complex and they wanted to make sure they had gathered all of the evidence they needed.

On Wednesday, Laval police announced three arrests of individuals alleged to be connected to the data breach. 

Imad Jbara, 33, and Ayoub Kourdal, 36, were charged with fraud, trafficking in identity information and identity theft. The third suspect has yet to appear in court.

Laval police also obtained an arrest warrant for a fourth suspect.

The data breach at the Quebec-based credit union is thought to be one of the largest ever among Canadian financial institutions, affecting roughly 9.7 million people and businesses.

In a statement on Thursday, Desjardins said it was "very pleased arrests have been made." 

"We would like to assure the authorities of our full co-operation in further proceedings," the statement said.