Desjardins: Final suspect in Desjardins data theft arrested in Mexico

Final Suspect in Desjardins Data Breach Arrested in Mexico

Maxime Paquette, the last remaining suspect in the Desjardins data breach investigation, was arrested in Cancun, Mexico, on July 16. The 40-year-old had been wanted by Quebec’s Sûreté du Québec (SQ) since June 2024 as part of Project Portier and Project D, which probed the theft and resale of personal data belonging to 9.7 million Desjardins members a breach first disclosed in 2019 that impacted nearly seven million Quebecers.

Paquette’s arrest marks the conclusion of the SQ’s hunt for all identified suspects in the case. Another fugitive, Juan Pablo Serrano, was detained in Spain in January 2026 and remains in custody pending extradition. Paquette faces charges in Canada, including fraud over $5,000, identity theft, and trafficking in identifying information. Authorities allege he used stolen Desjardins data between March 2018 and September 2020 to execute fraud schemes and sold compromised personal information on the dark web.

The SQ has previously warned that the exposed data remains unsecured. The breach, one of Canada’s largest, involved the unauthorized access and distribution of sensitive client information, with ongoing risks of financial fraud. Paquette will remain in Mexican custody while extradition proceedings move forward.

Source: https://publisherpt.substack.com/p/final-suspect-in-desjardins-data?utm_source=substack&utm_medium=email&utm_content=share&action=share

Desjardins TPRM report: https://www.rankiteo.com/company/desjardins

"id": "des1784220391",
"linkid": "desjardins",
"type": "Breach",
"date": "7/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '9.7 million',
                        'industry': 'Banking and Financial Services',
                        'location': 'Canada',
                        'name': 'Desjardins',
                        'size': 'Large',
                        'type': 'Financial Services Cooperative'}],
 'attack_vector': 'Unauthorized Access',
 'customer_advisories': 'Warning about ongoing risks of financial fraud',
 'data_breach': {'data_exfiltration': 'Yes',
                 'number_of_records_exposed': '9.7 million',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Personal and sensitive client '
                                             'information'},
 'date_detected': '2019',
 'date_publicly_disclosed': '2019',
 'description': 'Maxime Paquette, the last remaining suspect in the Desjardins '
                'data breach investigation, was arrested in Cancun, Mexico. '
                'The breach involved the theft and resale of personal data '
                'belonging to 9.7 million Desjardins members, first disclosed '
                'in 2019, impacting nearly seven million Quebecers. Paquette '
                'is alleged to have used stolen data for fraud schemes and '
                'sold compromised personal information on the dark web.',
 'impact': {'brand_reputation_impact': 'Significant',
            'data_compromised': 'Personal and sensitive client information',
            'identity_theft_risk': 'High',
            'legal_liabilities': 'Yes'},
 'initial_access_broker': {'data_sold_on_dark_web': 'Yes'},
 'investigation_status': 'Ongoing (Extradition proceedings)',
 'motivation': 'Financial Gain',
 'references': [{'source': 'Sûreté du Québec (SQ)'}],
 'regulatory_compliance': {'legal_actions': 'Fraud over $5,000, identity '
                                            'theft, trafficking in identifying '
                                            'information'},
 'response': {'law_enforcement_notified': 'Yes'},
 'threat_actor': 'Maxime Paquette, Juan Pablo Serrano',
 'title': 'Desjardins Data Breach',
 'type': 'Data Breach'}