January 7, 2026 A man involved in the massive Desjardins data breach that affected nearly 10 million clients has been arrested in Spain. The arrest of Juan Pablo Serrano on Nov, 6, 2025 followed a joint operation involving Spanish authorities, Quebec provincial police and Interpol. Once extradited, Serrano will face multiple charges, including identity theft, trafficking in identity information and fraud over $5,000, once extradited to Canada.
Serrano had been evading authorities since June 2024 after being accused of purchasing stolen data from a former Desjardins employee and using it in fraudulent schemes. The Desjardins data breach, first uncovered in 2019, has been described as one of the largest privacy breaches in Canadian history. The breach exposed the personal information of millions of Desjardins’ clients, including sensitive data from both Canadian and international individuals. According to authorities, it went on for over two years before the institution found out.
Quebec provincial police alleged that Serrano was involved in the theft and resale of the data, which he used for various fraudulent activities. He is accused of trafficking in the stolen information, contributing to a major identity theft operation.
The arrest of Serrano follows the capture of five other individuals in connection with the breach, including 42-year-old Sébastien Boulanger-Dorval, the alleged mastermind, 35-year-old François Baillargeon-Bouchard, 32-year-old Jean-Loup Masse-Leullier, 31-year-old Charles Bernier and 29-year-old Laurence Bernier. The operation has resulted in other arrests over the past few years but Serrano remained one of the most-wanted fugitives. Authorities had issued arrest warrants for him and other suspects, and Interpol’s Red Notice helped track him internationally.
Authorities have credited international cooperation, including support from the U.S. Secret Service, with the success of the operation. Serrano’s capture in Spain marks the end of a lengthy manhunt and is a significant step forward in addressing the fallout from the Desjardins data breach, which led to public scrutiny of Desjardins’ security practices. The Office of the Privacy Commissioner of Canada and the Commission d’accès à l’information du Québec published reports in 2020 that sharply criticized the financial institution for failing to protect its customers’ data adequately. These reports found that Desjardins had been aware of security weaknesses but did not take necessary actions in time to prevent the breach.
As Serrano remains in custody in Spain, authorities are now focused on his extradition to Canada, where he will face trial.
