Final Suspect in Desjardins Data Breach and Fraud Scheme Arrested in Mexico
The last fugitive in the multimillion-dollar fraud and data theft case involving Desjardins customers has been apprehended. Maxime Paquette, one of Quebec’s most-wanted suspects, was arrested in Cancún, Mexico, in a joint operation by the Mexican Navy and the Mexican Criminal Investigation Agency. He remains in Mexican custody pending extradition to Canada, where he faces charges including fraud over $5,000, identity theft, and trafficking of identities.
The 2019 Desjardins data breach compromised the personal information of 9.7 million clients, which was later sold to cybercriminals for fraudulent schemes. Paquette is accused of using stolen Desjardins customer data obtained between March 2018 and September 2020 to conduct fraud and distribute the information on the dark web. Authorities also linked him to the possession of confidential Desjardins customer data exposed in the 2019 breach.
Paquette’s arrest follows a two-year international manhunt involving Mexican authorities, the RCMP, and Interpol. His capture comes after the 2024 arrests of several other suspects in the SQ’s Portier investigation, including the alleged mastermind a former Desjardins marketing employee. Another fugitive, Juan Pablo Serrano, was arrested in Spain in November 2025.
Investigations revealed systemic failures at Desjardins, with the Office of the Privacy Commissioner of Canada and Quebec’s Commission d’accès à l’information concluding in 2020 that the financial institution had neglected critical security weaknesses. The breach went undetected for over two years before police alerted Desjardins in 2019. Meanwhile, Laval police continue to search for a remaining suspect, Nassim Alikacem, in connection with the misuse of stolen data.
Source: https://montreal.citynews.ca/2026/07/16/final-suspect-desjardins-data-breach-arrested-mexico/
Desjardins TPRM report: https://www.rankiteo.com/company/desjardins
"id": "des1784220432",
"linkid": "desjardins",
"type": "Breach",
"date": "5/2019",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '9.7 million',
'industry': 'Banking/Financial Services',
'location': 'Canada',
'name': 'Desjardins',
'size': 'Large',
'type': 'Financial Institution'}],
'attack_vector': 'Insider Threat, Dark Web Distribution',
'data_breach': {'data_exfiltration': 'Yes (sold on dark web)',
'number_of_records_exposed': '9.7 million',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (Personally Identifiable '
'Information)',
'type_of_data_compromised': 'Personal information, '
'Confidential customer data'},
'date_detected': '2019',
'date_publicly_disclosed': '2019',
'description': 'The 2019 Desjardins data breach compromised the personal '
'information of 9.7 million clients, which was later sold to '
'cybercriminals for fraudulent schemes. Maxime Paquette, one '
'of Quebec’s most-wanted suspects, was arrested in Cancún, '
'Mexico, for using stolen Desjardins customer data obtained '
'between March 2018 and September 2020 to conduct fraud and '
'distribute the information on the dark web.',
'impact': {'brand_reputation_impact': 'Significant',
'data_compromised': 'Personal information of 9.7 million clients',
'financial_loss': 'Multimillion-dollar fraud',
'identity_theft_risk': 'High',
'legal_liabilities': 'Fines, regulatory violations',
'operational_impact': 'Regulatory scrutiny, legal actions',
'systems_affected': 'Desjardins customer databases'},
'initial_access_broker': {'data_sold_on_dark_web': 'Yes',
'entry_point': 'Insider access (former Desjardins '
'employee)',
'high_value_targets': 'Desjardins customer data',
'reconnaissance_period': 'March 2018 – September '
'2020'},
'investigation_status': 'Ongoing (one suspect still at large)',
'lessons_learned': 'Systemic security weaknesses, delayed breach detection, '
'insider threats',
'motivation': 'Financial gain, Identity theft, Fraud',
'post_incident_analysis': {'root_causes': 'Insider threat, systemic security '
'failures, delayed detection'},
'recommendations': 'Enhance insider threat detection, improve monitoring, '
'strengthen regulatory compliance',
'references': [{'source': 'Desjardins Breach Announcement'},
{'source': 'RCMP/Interpol Investigation'}],
'regulatory_compliance': {'legal_actions': 'Charges including fraud over '
'$5,000, identity theft, and '
'trafficking of identities',
'regulations_violated': 'Privacy laws '
'(Canada/Quebec)',
'regulatory_notifications': 'Office of the Privacy '
'Commissioner of '
'Canada, Commission '
'd’accès à '
'l’information '
'(Quebec)'},
'response': {'law_enforcement_notified': 'Yes',
'third_party_assistance': 'RCMP, Interpol, Mexican Navy, Mexican '
'Criminal Investigation Agency'},
'threat_actor': 'Maxime Paquette, Former Desjardins marketing employee '
'(alleged mastermind), Juan Pablo Serrano, Nassim Alikacem',
'title': 'Desjardins Data Breach and Fraud Scheme',
'type': 'Data Breach, Fraud, Identity Theft',
'vulnerability_exploited': 'Systemic security weaknesses, undetected breach '
'for over two years'}