🔥 Trending Desjardins Data Breach: Fugitive Arrested in Mexico

The Desjardins data breach is one of Canada's largest financial services data breaches, involving the exposure of personal information belonging to millions of individuals ²⁴.

What Happened in the Desjardins Data Breach?

The breach, initially announced by Desjardins in 2019, involved an unauthorized individual, an employee, who exfiltrated sensitive data ³¹. Desjardins Group is North America's largest credit union federation, serving over 7.5 million members with nearly $400 billion in total assets ².

The breach compromised personal information including names, addresses, birthdates, Social Insurance Numbers (SINs), email addresses, and transaction details ⁴. Initially, it was reported that 2.9 million individuals were affected ¹, but later estimates indicated that approximately 4.2 million individuals had their data compromised ⁴.

Key Details and Timeline:

• Initial Discovery (2019): Desjardins announced the breach in 2019, attributing it to an insider ³.
• Data Resurfacing (2025): Sensitive information belonging to over a million Quebecers from the 2019 breach resurfaced on the dark web in October 2025, linked to an extortion attempt ⁵.
• Ongoing Impact: The breach has had a lasting impact, leading to class-action lawsuits and ongoing efforts to apprehend those responsible ³.

Who is Maxime Paquette?

Maxime Paquette is one of the individuals sought in connection with the massive data breach at Mouvement Desjardins financial group ⁶. He was among Quebec's most wanted suspects ⁶.

Arrest and Developments:

• Arrest in Mexico (Specific Date Not Provided): Paquette was arrested in Mexico ⁶.
• Other Arrests: Another key suspect, Juan Pablo Serrano, who was wanted Canada-wide for multi-million dollar fraud and data theft related to Desjardins clients, was arrested in Spain on November 6, 2025 ⁷. Serrano remains in custody ⁷.

The Desjardins data breach highlights the significant risks posed by insider threats and the long-term consequences of such incidents, including the potential for compromised data to resurface years later ¹⁵.