Arrest in Cancun
Maxime Paquette, identified as one of Quebec’s most sought-after fugitives, has been apprehended in Mexico. The arrest was made in Cancun during an operation that involved the Mexican Navy and the Mexican Criminal Investigation Agency. Paquette had been sought by authorities since June 2024 in connection with a significant data breach at Mouvement Desjardins.
The Sûreté du Québec (SQ) confirmed the arrest, noting that Paquette will remain in the custody of Mexican law enforcement officials. An extradition process is underway to bring him to Canada, where he faces multiple charges. These charges include fraud exceeding $5,000, identity theft, and trafficking of identities.
This arrest marks a significant development in the investigation into the Desjardins data breach, which impacted a large number of clients. The manhunt for Paquette spanned over two years and involved cooperation between Mexican authorities, the RCMP, and Interpol, among other agencies. The SQ extended acknowledgments and thanks to the various entities that assisted in the investigation, indicating the large-scale nature of the operation.
Details of the Investigation
The Desjardins data breach, which came to light in 2019, affected approximately 9.7 million clients both in Canada and internationally. Police have stated that personal information was obtained by suspects and subsequently sold to individuals involved in various fraud schemes. The breach reportedly occurred over a period of more than two years before Desjardins became aware of it, and only after notification from the police.
Paquette is alleged to have conducted various fraud schemes using data from Desjardins members and customers. This information was reportedly acquired through illegal means between March 2018 and September 2020. Furthermore, in 2021, he was allegedly found in possession of confidential information belonging to Desjardins customers that was exposed in the 2019 breach. The SQ also indicated that he sold identifying information from the stolen Desjardins lists to several individuals and on the ‘Dark Web’.
Several other suspects were arrested in 2024 as part of the SQ’s “Portier” investigation. Among those apprehended was the alleged architect of the scheme, an individual who had worked in the marketing department at the financial institution. Paquette and Juan Pablo Serrano were the last two suspects who remained at large. Serrano was arrested in Spain in November 2025.
Regulatory Findings and Ongoing Efforts
In 2020, both the Office of the Privacy Commissioner of Canada (OPC) and the Commission d’accès à l’information du Québec released reports concerning the data breach. These reports concluded that Desjardins had not demonstrated the necessary level of attention to protect its customers’ data. The OPC report specifically noted that Desjardins was informed about the breach involving nearly 9.7 million individuals on May 27, 2019.
The OPC report also found that Desjardins had been aware of security weaknesses that contributed to the breach but failed to address them in a timely manner. The breach’s duration, spanning over two years before its discovery by Desjardins, highlighted the institution’s delayed response. This situation underscores the importance of robust data protection measures within financial institutions.
Beyond the arrests made in connection with the data breach, Laval police are continuing their investigation into the use of stolen data. They are currently seeking another suspect, Nassim Alikacem, in relation to these ongoing efforts. The arrest of Maxime Paquette in Cancun marks a significant step in addressing the consequences of the Desjardins data breach.
Read Also
Source: montreal.citynews.ca
