The Sûreté du Québec has confirmed the arrest in Mexico of a man wanted in connection with a major data breach at Mouvement Desjardins that exposed the personal information of nearly 10 million clients.
International operation led to detention in Cancun
The arrested individual, identified by Quebec police as a 40-year-old named Maxime Paquette, was taken into custody in the resort city of Cancun, the provincial force said in a statement. Paquette had been sought by authorities since June 2024 over the theft of client information dating from 2017 to 2019.
According to the Sûreté du Québec, Paquette will remain in Mexican custody while extradition proceedings are pursued. In Canada he faces criminal charges that include fraud, identity theft and trafficking in other people’s identities.
Co‑ordinated effort by multiple agencies
Quebec’s provincial police acknowledged contributions from several national and international partners in locating and arresting the suspect. They singled out assistance from:
- Interpol
- Quebec City police
- Mexico’s navy
- Mexico’s criminal investigation agency
- Cancun State Security Secretariat
The SQ declined to provide further comment on the circumstances of the arrest on Thursday, but its public acknowledgements suggest the probe involved a significant cooperative effort across borders and agencies.
Background and local implications
The Desjardins breach, which affected millions of clients, has been one of the highest‑profile data‑privacy incidents in recent provincial memory. The alleged theft of personal records spanning 2017 to 2019 prompted investigations by multiple law‑enforcement bodies and raised questions about how financial institutions safeguard customer information.
For affected clients, the case underlines ongoing concerns about identity security, and it may spur renewed calls for stronger oversight and remediation measures from both the financial sector and provincial regulators. Any forthcoming extradition and criminal proceedings in Canada will also be closely watched for what they reveal about the organization of the breach and the handling of the stolen data.
| Key dates | Detail |
|---|---|
| 2017–2019 | Period during which client's personal information was taken |
| June 2024 | Authorities began actively seeking the suspect |
| July 2026 | Arrest reported in Cancun, Mexico |
Investigators and legal authorities in Canada will now need to work through the formal extradition process before the suspect can face charges at home. The SQ did not disclose whether charges are already laid in a specific court or the timeline for transfer.
The arrest represents a significant development in a case that has had long‑running repercussions for customer confidence in Quebec’s financial institutions and for how personal data is protected across the country.
