A man wanted Canada-wide in connection with a multimillion-dollar fraud and data theft of Desjardins clients was arrested in Spain, according to Quebec provincial police.
The Sûreté du Québec says Juan Pablo Serrano, considered among the province’s most wanted fugitives, was arrested Nov. 6, 2025. He remains in custody in Spain.
Authorities say Serrano will be extradited to Canada where he will face charges of fraud, identity theft and trafficking in identity information.
A massive Desjardins data breach in 2019 affected 9.7 million clients. Police have said suspects obtained personal information, which was then sold to “malicious individuals operating several fraud schemes.”
Several suspects were arrested in 2024 as part of the SQ’s “Portier” investigation, including the alleged architect of the scheme — a man who worked in the marketing department at the financial institution.
Serrano had been wanted since June 2024. The charges against him have not been tested in court.
The Office of the Privacy Commissioner of Canada and the Commission d’accès à l’information du Québec published scathing reports in 2020 that concluded Desjardins failed to show the level of attention required to protect its customers’ data.
The OPC report said Desjardins notified the federal office on May 27, 2019, about a breach involving close to 9.7 million individuals in Canada and internationally. It found that Desjardins had been aware of the security weaknesses that led to the breach, but failed to address them in time.
The breach occurred “over more than a two-year period before Desjardins became aware of it, and then only after the organization had been notified by the police,” the report said.
–With files from The Canadian Press