4 more arrests, including primary suspect, in connection with Desjardins data leak

Quebec provincial police have arrested four more people with crimes tied to a massive data breach at Desjardins, including the former bank employee originally suspected of being behind the leak.

The four people, three men and one woman, were arrested early Thursday morning, hours after Laval police announced arrests of their own tied to the case. 

Provincial police charged them with fraud, identity theft and the illegal possession and sale of personal information. One of the four, Sébastien Boulanger-Dorval, 42, was also charged with using a computer for fraud. 

Boulanger-Dorval was the primary suspect in the leak. He worked at Desjardins on a marketing team at the time of the leak and allegedly justified selling the leaked data to pay debts.

In addition to Boulanger-Dorval, police arrested and charged Jean-Loup Masse-Leullier, Laurence Bernier and François Baillargeon-Bouchard. Provincial police also issued arrest warrants for four other people: Maxime Paquette and Pablo Serrano, who police believe are hiding abroad, and Mathieu Joncas and Charles Bernier. 

The charges against those arrested on Thursday allege they committed their crimes between Oct. 1, 2016, and May 27, 2019.

The Desjardins data leak was only revealed to the public in 2019 and the authorities only became aware in December 2018 when a suspicious transaction told them something was amiss.

Benoit Richard, the coordinator of broadcasting and media relations with the Sûreté du Québec, said it took years for investigators to make arrests because the investigation was complex and they wanted to make sure they had gathered all of the evidence they needed.

On Wednesday, Laval police announced three arrests of individuals alleged to be connected to the data breach. 

Imad Jbara, 33, and Ayoub Kourdal, 36, were charged with fraud, trafficking in identity information and identity theft. The third suspect has yet to appear in court.

Laval police also issued an arrest warrant for a fourth suspect.

The data breach at the Quebec-based credit union is thought to be one of the largest ever among Canadian financial institutions, affecting roughly 9.7 million people and businesses.