Desjardins announces internal security breach
Desjardins, a Canada-based credit union and bank, has announced a security breach caused by a former employee. 
A police investigation opened in Laval, Quebec, (which Desjardins has been closely involved with) has revealed that the personal information of 2.9 million members (2.7 million personal members and 173,000 business members) was disclosed to individuals outside Desjardins without authorisation.
The bank said it fired the employee after learning of the incident from the police on 14 June 2019.
“When just one employee, reportedly acting without acolytes, has an uncontrollable access to such a huge amount of confidential data and even manages to take it away, there is reason to believe that some of the internal security controls are broken,” says Ilia Kolochenko, founder and CEO of web security company ImmuniWeb.
Kolochenko believes that the human factor remains the largest and probably the most dangerous risk that cannot be fully remediated. He believes that most companies considerably underestimate human risk and then face disastrous consequences.
However, his caveat is that a malicious employee is a much more complicated case.
“Firstly, security teams are already overloaded with tasks, processes and endless alerts, and therefore frequently disregard incidents caused by presumably trusted colleagues. Worse, some of the employee’s malicious activity is technically undistinguishable from the legitimate daily work. Nonetheless, major incidents akin to this one, are usually easily detectable and preventable.”
Outside of North America, security firm, Telestra conducted research that found that 25% of UK-based companies surveyed experienced security incidents due to intentional employee actions monthly, and 22% said it occurred every six months.
In light of these events, Desjardins has enforced additional security measures to ensure all their members’ personal and financial data remains protected.
