On June 20, 2019, Desjardins announced the largest theft of confidential data of the history of Quebec. A year later, several brokers and small private lenders which would have shared the loot are very difficult to bring them to justice, learned our Bureau of investigation.
According to our sources, the public prosecutor can not prove that the financiers of Québec suspected of having acquired the data knew that they had been stolen.
The private lender and mortgage broker Mathieu Joncas, his partner in the insurance broker Francis Baillargeon-Bouchard and the mortgage broker Marc-Olivier Tanguay plead ignorance. They insist they were unaware that such lists of customers were obtained illegally, according to our information.
This will be much easier to move the handcuffs to Sébastien Boulanger Dorval, the ex-employee of Desjardins, which would have captured data, and to John Wolf Leullier Mass, which he would have purchased for a few gift cards to supermarkets and restaurants St-Hubert.
Other charges possible
The chances are slim, but prosecutors could try to use other sections of the act, according to our sources.
“In the criminal Code, there are a series of provisions dealing with computer crimes,” says the criminal lawyer Jean-Claude Hébert.
According to him, the prosecution could fall back on the head of the” unauthorized use of a computer “, which allows you to punish computer crimes.
“It depends on the quality of the evidence, but there might be also possibility to use some heads of fraud,” said Isabelle Briand, a former prosecutor.
One thing is certain, the three brokers have big problems with the agencies that oversee their professions.
Tanguay has even pleaded guilty to having bought the stolen data of 5000 clients of Desjardins group, in front of the discipline Committee of the self-regulatory Body of real estate brokers in Quebec.
Analyses still in progress
The investigation of the Sûreté du Québec on the data theft at Desjardins began in September 2019 with a wave of searches and 17 “persons of interest” were questioned.
The mass of information that the police collected is so large that the police has still not finished analyzing it, eight months later.
If you have new information on the flight data at Desjardins, contact Hugo Joncas to firstname.lastname@example.org or Félix Séguin to email@example.com
Sébastien Boulanger Dorval
It is this former specialist of the segmentation of the markets at Desjardins, who is believed to have stolen the confidential data of the 4.2 million members of the financial co-operative, and 1.8 million holders of credit cards.
He would have then been forwarded to Jean-Loup Leullier Mass, a private lender, Chaudière-Appalaches, for a few thousands of dollars in gift cards to supermarkets and restaurants, St-Hubert, according to our sources.
To put the hand on the data, Baker Dorval has not had to hack anything, according to sources, it security at Desjardins, who do not have the permission to speak. As fifty other people, he could copy this information without penalty.
Desjardins said to the contrary, that its former employee did not have the access needed to extract the data.
“He had to use a ploy to get them “, assured the spokesperson Chantal Corbeil, in October 2019, with no further details.
Jean-Loup Leulier Mass
It is believed to have bought stolen data by Sébastien Boulanger Dorval.
According to our information, only he and Baker Dorval may be accused of theft and concealment of data.
Emails of a confidential source of the syndic of the Organisme d’autoréglementation du courtage immobilier du Québec (OACIQ) allow to learn a little more about this ancient, private lender Montmagny.
According to these messages, Leullier Mass would have affected not less than $ 100,000 to sell part of the stolen information to another private lender and mortgage broker from Quebec, Mathieu Joncas.
The trustee has filed these e-mails before the discipline Committee of the OACIQ in the context of proceedings against a broker-dealer who purchased a part of the stolen data to Desjardins.
From 2016 to 2019, Leullier Mass was a shareholder of two companies, one for private loans, the Financial Blackstone and Solutia Finance.
His name, however, has disappeared from the sheets of the two companies in June 2019, when Desjardins announced the theft of the personal data of millions of its members. His partner, Charles Bernier, became the sole shareholder of these firms on paper.
This private lender and mortgage broker is not likely to be criminally charged for having bought the stolen personal data to Desjardins. It does, however, face a complaint by the syndic of the OACIQ.
Mathieu Joncas has had access as early as 2016 to lists of clients of Desjardins group, according to emails from an anonymous source sent in the folder of another broker sentenced in this case. According to this source, he would have paid $ 100,000 to put the hand on these information.
Our investigation Bureau is unaware of the identity of this source, but the trustee has considered his statements quite credible for the file in evidence.
Joncas has also continued for months its activities as a private lender, even after the raids targeted the group of small financial covered by the police investigation. Last January, he gave a mortgage to a couple in Quebec, according to the land registry.
In 2014, Joncas had to pay 3600 $ for fines for having encouraged two of its employees to the brokerage so that they had no permit allowing them.
Since January, the financial markets Authority (AMF) attempts to withdraw his right to practice at the insurance broker, partner of Mathieu Joncas. He would have bought the data of 40 000 clients of Desjardins group for $40,000.
The next hearings will take place at the end of the month. By then, Baillargeon-Bouchard can continue its activities as if nothing had happened.
In its request for an order to suspend his broker license, the Authority mentions that it has continued to use the lists stolen at Desjardins until October 2019. It is a month after the searches in the investigation into the theft and concealment of such information.
Baillargeon-Bouchard worked hand-in-hand with Joncas. He recommended the customers to which it sold mortgages that they retain also the services of his partner as an insurance broker. They shared then the commissions, according to the order of the AMF.
The data that they had redeemed contained in particular the balance of the mortgage and various insurance premiums paid by clients of Desjardins group.
Mortgage broker and former employee of Mathieu Joncas, he is the only one so far to pay any prize to have used the stolen data.
In may, he pleaded guilty to having bought for 3000 $ the information confidential on 5000 clients of Desjardins group, in front of the discipline Committee of the OACIQ. He is waiting to hear his punishment.
Marc-Olivier Tanguay has purchased the information of Jean-Loup Leullier Mass in January 2019, at a meeting in a restaurant.
Sign that he suspected that the source of the data was questionable, Tanguay was paid in cash and has not asked for bill, he acknowledged. It was also agreed that the list that he has sold Leullier Mass included, ” confidential information “.
The stolen personal information to Desjardins have helped negotiate three mortgage transaction, according to the summary of facts filed with the discipline Committee.
While the network of brokers and private lenders who have seen the stolen data has gravity around him, according to court filings. The police has however never treated as a suspect.
The investigation into the theft of this information began with a search of the police of Laval, in the offices of the company, private loans of Charles Bernier Montmagny, as of June 6, 2019.
His name appears several times in the evidence against a broker-dealer that has bought a part of the data, Marc-Olivier Tanguay (below).
In his case, the syndic of the OACIQ has filed e-mails from a confidential source. One of them mentions that Bernier was one of the first to manipulate data of Desjardins with his partner Leullier Mass, as early as 2016.
At the time, Bernier was working for Mathieu Joncas.
“Joncas has had access to the lists through one of his employees, Charles [Campbell] and his friend, the famous Jean Loup [Leullier Mass],” writes the source of a trustee in an e-mail.
She said that Bernier has quickly figured out he could make a lot of money with the stolen data.
Still in business
For the past year, the operations of Bernier continue as if nothing had happened. The call centre of his company, private loans, Solutia Finance, was still operating this week.
With respect to its business of mortgage lending, the Financial Blackstone, it has seized a house from Plessisville to get repay a loan in December of last year, according to the land registry. Its last mortgage was in February last, in Montmagny.
Blackstone has received, in 2018 a notice of violation to the Office of consumer protection for a series of violations of the law. In particular, she was charged interest of up to 467 per cent per year, well above the maximum rate of 60 % falls under the criminal Code.
A real saga
An individual does with the personal information of a member at Desjardins bank in a financial institution in Laval. An investigation is open during the following days.
22 MAY 2019
Police in Laval transmit the first information to the co-op, especially in regards to a file that is apparently the result of a search.
Desjardins receives data from police showing that 2.9 million members will be affected.
The management of the cooperative Lévis is organising a press conference to announce the leak of personal information of approximately 2.9 million individuals and businesses.
Desjardins announces measures to help its members to subscribe to the monitoring service Equifax credit.
The co-operative launches Protection Desjardins members against identity theft for all of its customers.
The company announces that the number of victims goes up to 4.4 million with the affected companies.
Departure of the first executive VP and chief operating officer, Denis Berthiaume, and the first VP of information technology, Chadi Habib.
Desjardins expands its protection against identity theft with over 8 million members, including holders of credit cards, financing products and insurance.
The president Guy Cormier has been re-elected by acclamation at the head of the co-op for another term of four years.
FEBRUARY 26, 2020
Desjardins announced that the data breach has cost it $ 108 million up to this moment. The management admits to having paid in connection with identity theft.
1 719 312 individuals were registered with Desjardins to the monitoring service from Equifax. In addition, 1 190 871 people have used the service My Credit Rating TransUnion, through Online, to view their credit report from the event.
MAY AND JUNE
Desjardins takes over the sending of letters to customers of credit cards and Accord D to notify them that their data had been compromised. The initiative started in January had been interrupted as a result of the pandemic.