We tend to picture the attacker on the other side of the world, hooded in front of six screens. The reality is often more mundane, and much closer to home.

Key points

  • The largest data breach in Canadian history started from the inside.
  • No sophisticated malware was involved: just access that was too broad, granted to one person.
  • Two principles cover most of this scenario: least privilege and traceability.
  • The data resurfaced six years later, showing how long a leak like this can remain exploitable.

What actually happened at Desjardins?

Between 2019 and 2025, an employee illegally exfiltrated the personal information of members of the Mouvement Desjardins. In total, 9.7 million members and clients were affected. The Sûreté du Québec’s Projet Portier led to several arrests on June 13, 2024.

The charges cover fraud, identity theft, and trafficking in personal information. Then, in October 2025, the data of roughly one million Quebecers resurfaced on the dark web as part of an extortion attempt.

That last point deserves more of an executive’s attention than the initial volume. A leak of personal information has no expiry date: it gets resold, cross-referenced with other datasets, and continues to fuel fraud years after the original incident.

timeline title Anatomy of an insider leak 2019 : Exfiltration by an employee 2024 : Arrests (Projet Portier) 2025 : Data resurfaces on the dark web

Why is the insider threat so poorly covered?

Because security tools are built to spot an intruder, not a colleague. An employee accessing files they are authorized to view triggers no alert. Without logging of access and without limits on permissions, the incident stays invisible until someone else exposes it.

There was no zero-day vulnerability here, no elaborate malware. Just access that was too broad, granted to one person, without enough segmentation or logging to raise the alarm in time.

The insider threat is not always malicious, either. Negligence produces the same outcome: a database export sent to a personal email address to “work on tonight,” a client file dropped into a consumer file-sharing service. No intent to cause harm, yet still a confidentiality incident under Law 25.

How can an SMB protect itself?

Two non-negotiable principles, and one practical consequence. Least privilege: everyone has access only to what they strictly need. Traceability: knowing who accessed what, and when. Without logs, an incident stays invisible until it becomes a disaster.

  • Least privilege. The useful exercise is to list, for each role, the data it should have access to, then compare that against the permissions actually in place. The gap is almost always larger than expected.
  • Traceability of sensitive access. Log access to client or employee data, and keep those logs out of reach of the people they record.
  • Separation of duties. The same person should not be able to both export a database and erase the trace of that export.
  • Departure as a security event. An offboarding checklist, as systematic as returning building keys, that revokes access the same day.

We help SMBs tighten access controls, trace sensitive activity, and detect abnormal behaviour, before it makes headlines.

FAQ

Is monitoring employees legal in Quebec?

Logging access to business systems is a standard, expected security measure, including in the view of the Commission d’accès à l’information (Quebec’s access-to-information oversight body), which requires measures proportionate to the sensitivity of the information involved. What is regulated is the purpose and transparency: monitoring must aim to protect data, remain proportionate, and employees must be informed of it. A written policy, communicated and applied consistently, is the usual framework.

We’re a team of ten, is separation of duties realistic?

Not in its textbook form, and it’s not worth exhausting yourself over. What remains workable is simpler: identify the two or three operations that are genuinely sensitive, for example exporting the client database or changing a supplier’s banking details, and require a second person to approve them. Everything else can stay flexible without exposing the organization.

How can an exfiltration in progress be detected?

Through volume and behaviour signals rather than fixed signatures. An account that accesses more files in a single day than in its usual month, a login at an unusual hour, an unusual download volume. These comparisons require knowing what normal behaviour looks like in the environment, which is exactly what modern detection tools learn to do, and what a simple threshold rule cannot.

Sources