Suspect in Desjardins Data Breach That Affected 9.7 Million Canadians Arrested in Spain

Spanish authorities have arrested a suspect wanted by Quebec authorities in connection with the 2019 Desjardins data breach that compromised the personal information of nearly 9.7 million Canadians.

Quebec provincial police announced on Jan. 6 that Juan Pablo Serrano was located and arrested on the evening of Nov. 6, 2025, following a joint operation involving Spanish authorities and Interpol. Serrano, a Canadian citizen of Ecuadorean origin, had been wanted since June 2024.

“He will remain in custody in Spain while extradition proceedings are initiated for his return to Canada, where he will have to respond to several charges under the Criminal Code,” the Quebec provincial police said.

Serrano, who was among Quebec’s most wanted fugitives, is accused of obtaining sensitive data from Desjardins’ database and using it to carry out various fraud schemes.

Desjardins in 2019 reported a data breach involving the personal information of a number of its members and customers, including first and last names, dates of birth, social insurance numbers, residential addresses, telephone numbers, email addresses, and transaction histories.

The company concluded the data leak had been committed by one of its employees, who had been exfiltrating personal information over a period of at least 26 months.

An investigation by the Office of the Privacy Commissioner of Canada (OPC) concluded in 2020 that the breach, which it described as “the largest ever in Canada’s financial services sector,” was due to gaps in administrative and technology safeguards at Desjardins.

“Desjardins had already identified some of the deficiencies that ultimately led to the breach, but was too slow to react,” Daniel Therrien, former privacy commissioner of Canada, said in a Dec. 14, 2020, statement. “That being said, the organization did respond very well once it was informed of the breach.”

In response to the OPC’s report at the time, Desjardins said it had “made great strides in information security over the past 18 months and will continue to apply international best practices.”

Serrano faces several charges, including fraud of more than $5,000, identity theft, and trafficking in identity information.

The Quebec provincial police in 2024 arrested four people in connection with the case, including Sébastien Boulanger-Dorval—the accused employee—Jean-Loup Masse-Leullier, François Baillargeon-Bouchard, and Laurence Bernier.

Boulanger-Dorval worked in the marketing department of the Quebec-based financial institution until 2019, when the breach occurred.

Maxime Paquette, another man police allege was involved in the data breach and who is also among Quebec’s most wanted fugitives, remains at large.