DBRS Morningstar Comments on Desjardins Group’s Update on the Unauthorized Access of Member Data

DBRS Limited (DBRS Morningstar) notes that on November 1, 2019, Desjardins Group (Desjardins; rated AA with a Stable trend by DBRS Morningstar) announced that a total of 4.2 million members had been affected by the data breach, up significantly from the 2.9 million members originally thought to be affected back in June (see the DBRS Morningstar press release, “DBRS Comments on Unauthorized Access of Desjardins Group Member Data”). Despite the larger magnitude of the breach, DBRS Morningstar still does not anticipate any adverse rating implications.

In DBRS Morningstar’s view, the reputational and financial impacts on Desjardins have been manageable. Importantly, the data theft does not appear to have negatively affected the franchise. Indeed, since the original announcement of the data theft, Desjardins has reported an increase in membership, as well both healthy loan and deposit growth. Moreover, Desjardins continues to access wholesale markets in a cost-effective manner.

Following the data theft, Desjardins has strengthened its internal systems to restrict data access by non-essential personnel in addition to implementing more stringent checks on external data flows. DBRS Morningstar notes that the usefulness of the data to enable wide-scale fraud remains limited given that the stolen data did not include more sensitive information, such as personal identification numbers, passwords or security questions. Desjardins reiterated its commitment to reimburse existing and new members for potential losses incurred from identity theft for up to $50,000 in addition to extending credit protection monitoring through Equifax to all its affected members for a period of five years.

Notes:
All figures are in Canadian dollars unless otherwise noted.

For more information on this credit or on this industry, visit www.dbrs.com.

DBRS Limited
DBRS Tower, 181 University Avenue, Suite 700
Toronto, ON M5H 3M7 Canada