7 ms·
Personal data of 2.9M people leaked from Desjardins
- nbrempel 7y ago> The federation's CEO and president, Guy Cormier, said the security breach is not the result of a cyberattack, but the work of an employee who improperly accessed and shared the information. > That employee has been fired. > Cormier said he felt "betrayed" by the former employee's actions. Fired? How about arrested?
- Flott 7y agoThere is an ongoing criminal investigation as far as I know.
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- peeters 7y agoThe article: > That employee has been fired. He was arrested by Laval police but has not yet been charged.
- Flott 7y agoThe article is getting edited live. It was not in the article when it was first posted by OP but thank you for pointing that out!
- Scoundreller 7y agoLetsee, 5 minutes of wasted time per impacted client (and that’s just to interpret and ignore the notice) * 2.9 million people = 28 years of life lost by one action. Basically a murder in terms of aggregate impact.
- ZeroFries 7y agoWasting 10s of 5 billion people's time = 1585 years of life or 27 lives, but I think most would agree killing 27 people is far worse. You can't really equate the two.
- Scoundreller 7y agoThese comparisons happen all the time in government. Do you get more value out of spending $1m (ie: 100 000 person hours of taxes at $10/hr) on saving a few people's lives through improving a highway's safety, through a vaccination program, or an exercise program? Or just let people keep an extra $10, take an hour off work, and lose 0.0003% of their life (on average!) by increasing their risk of harm in a highway collision?
- abledon 7y agoLol with that logic most developers who implement an annoying pop up banner subscription/greeting chain combo on a high traffic site are committing an action equal to murder
- Scoundreller 7y agoThe maintainers of uBlock Origin have a lot of "Get out of Jail" credits to exchange if they ever need to.
- deleted 7y ago[deleted]
- _asummers 7y ago> The information includes names, addresses, birth dates, social insurance numbers, email addresses and information about transaction habits. Oooof. > However, Desjardins said, passwords, security questions and personal identification numbers have not been compromised. Well that's a relief! Glad the things that are easy to change are safe.
- Raphmedia 7y agoIt's very bad from a privacy standpoint but at least nobody will be able to log-in to my account and send all my money offshore.
- _asummers 7y agoInstead they can steal your identity and open accounts in your name. Banks can automate the changing of passwords and PINs by requiring the former information to change the latter. But once it's out there, it's gone forever.
- kgwgk 7y agoI know identity theft is not a joke, but (I'm too lazy to check how does it work in Canada, this is for the US): • Under most state laws, you're not responsible for any debt incurred on fraudulent new accounts opened in your name without your permission. https://www.consumer.ftc.gov/articles/pdf-0009_identitytheft_a_recovery_plan.pdf https://www.consumer.ftc.gov/articles/pdf-0009_identitytheft...
- simlevesque 7y agofuuuck > Anyone whose data was affected will receive a 12-month credit monitoring plan, paid for by Desjardins. That service includes access to daily credit reports, alerts of any changes and identity theft insurance. > "I want to be really clear," said Cormier. "Our members will be reimbursed [for any losses they incur.] There will be no cost to our members." Not bad.
- purephase 7y agoNo clear mention of whether those impacted will be notified though.
- jacobroyquebec 7y agoNot in the article, but Desjardins has set up a webpage with information on the leak.[0] They will send a letter to every clients whose informations were leaked, which will include the code for a free 12-month Equifax (credit report) monitoring. [0] https://www.desjardins.com/renseignements-personnels/index.jsp https://www.desjardins.com/renseignements-personnels/index.j...
- appleiigs 7y agolol equifax
- glerk 7y agoI was impacted by this and was notified via internal message (on the Desjardins AccesD online banking portal).
- Scoundreller 7y agoIs 12 months ever enough monitoring?
- Raphmedia 7y agoAccording to them, there's permanent monitoring in place. This free paid plan is simply a bonus. We introduced additional monitoring and security measures to protect your personal and financial information. We notified the following authorities: the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec and the Autorité des marchés financiers.
- Raphmedia 7y agoMore informations from Desjardins: https://www.desjardins.com/ca/personal-information/index.jsp https://www.desjardins.com/ca/personal-information/index.jsp
- yters 7y agoIn this world of NSA, data leaks and FAARG, the only way forward is undocumented births and backwoods medicine to avoid personal information being at the mercy of the state, corporations and criminal organizations.
- luckylion 7y agoIf it was possible for an employee to "access and share" 2.9m datasets, it's the company's fault. No matter who the employee is, if you don't have safeguards in place as a credit union, you aren't doing your job. Like, at all.
- kgwgk 7y agoHow should you do your job so no employee has access to that information? I’m sure they could have been more careful, but the risk cannot be completely eliminated without going to impractical extremes...
- shakna 7y agoScope of Access Request is the usual implementation. An employee should not be able to iterate millions of records without first asking for temporary powers. You set the scope by measuring the usual required, and putting in a procedure for when and how much various supervisors can expand it. Different departments will have different needs. This stuff is already built in to industry standard software like SAP.
- luckylion 7y agoshakna already gave some good points, but a major one is the shared part. Even if it's an admin that moves around a backup file from server a to server b, you don't allow anyone to bring in and connect USB drives. You don't allow personal laptops to access files (on that level - accessing a frontend is fine, see access limits) that leave the premises. That's not impractical, it's not extreme, it's just what you do when you handle very important data of millions of users. Making sure nobody can access data wholesale is step one. You will fail at some point for some reason. Making sure no one can exfil large amounts of data is step two. If he wants to go James Bond on you and use a small camera to photograph his screen, good. Data leaks suck, but this way, it will affect a hundred people, not 2.9m.
- kgwgk 7y agoSure, but you need processes to get all the names and adresses every time you send statements by mail, for example. Someone somewhere needs to be able to access the data. Not “everyone”, but not “nobody” either. How do disable access from database admins? Do you keep all the listings in microfilms in a safe in a guarded room in the basement?
- apo 7y ago> The information includes names, addresses, birth dates, social insurance numbers, email addresses and information about transaction habits. It's starting to look downright irresponsible to regard such information as private these days. As such, it should be considered irresponsible to base any portion of a verification protocol on that information.
- thooranpoyi 7y agoThis isn't surprising, As is with everything with Québec, Desjardins is a Québec based business. They will still retain their customer base. Their site's UX was so bad that I didn't use them as my bank. Their English customer service sucks too. Glad I made that choice. A data breach is still a data breach even if it was by a rogue employee. By the looks of it, Quebec's Communauto is next in the line.
- Thaxll 7y agoSo the bank itself didn't found out the issue but was told by the police, I'm really curious about monitoring process at banks...
- dredmorbius 7y agoI've been looking into this recently Because Reasons. The story's pretty poor in most places. Brian "Krebs on Security" Krebs wrote a bit in March 2018 on the state of bank online security. Virtually all of it is outsourced to a handful of major service providers: Fiserv, Jack Henry, FIS, CSI, and Finastra. https://krebsonsecurity.com/2018/03/what-is-your-banks-security-banking-on/ https://krebsonsecurity.com/2018/03/what-is-your-banks-secur... I don't find any indication of what Desjardins' security is based on.
- txcwpalpha 7y agoIME, It's very, very, very common for law enforcement to be the ones that first detect signs of a breach and track it back to the affected company, at banks and elsewhere.
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- canada_dry 7y agoAs a retired IT Exec (I worked in Cdn banking for over a decade) this kinda thing used to keep me up at night! To mitigate the risk I wanted to implement a blanket USB plug-n-play restriction but the client-side Execs overruled me. Fortunately a leak never happened, but really it was just good fortune.
- Terretta 7y agoAs a current IT exec in banking, a thing that keeps me up at night is the “go to” strategy of compromising employees’ ability to use productivity tools for “security”. If you follow the lock-it-down strategy to the max, you eventually unplug the computer and keep it in a vault. Since you wouldn’t do that, that means you recognize that security can’t be at the expense of all utility. So what is the right amount of utility to sacrifice in order to achieve security? I’d argue — try for none. Make infosec the happy path.