Juan Pablo Serrano, who has been sought since June 2024 in connection with a significant data breach at Desjardins, was apprehended in Spain, as announced in a press release by Quebec provincial police on Tuesday. The arrest of Serrano on the evening of November 6, 2025, was the result of a collaborative effort involving Spanish authorities, provincial police, and Interpol. He was identified as one of Quebec’s most wanted fugitives and is being pursued by the financial crimes and cybercrime investigation unit as part of Project Portier, which is a comprehensive probe into the Desjardins data breach.
The investigation was launched following the revelation that personal data belonging to millions of Desjardins Group members had been illicitly accessed by individuals external to the financial institution. To track down Serrano internationally, provincial police disclosed that Interpol had issued a red notice, requesting global law enforcement agencies to locate and detain him for extradition to Canada. Serrano is presently in custody in Spain and is slated to face charges of identity theft, fraud exceeding $5,000, and trafficking in identity information upon his return to Canada.
Back in June 2024, authorities had shared details online about the 40-year-old fugitive, alleging that he had acquired lists of data pertaining to Desjardins members and customers through an accomplice named Sébastien Boulanger-Dorval and had carried out various fraudulent activities using the obtained information. Notably, Boulanger-Dorval, who was arrested the same month, faced charges related to fraud, identity theft, illegal possession, and sale of personal information, along with using a computer for fraudulent purposes. He was identified as the primary suspect in the investigation and had been employed in the marketing department at Desjardins during the breach, purportedly selling the leaked data to settle debts.
The Desjardins data breach, disclosed to the public in 2019, came to authorities’ attention in December 2018. It is regarded as one of the largest breaches among Canadian financial institutions, impacting approximately 9.7 million individuals and businesses. The successful apprehension of Serrano was highlighted by the Sûreté du Québec (SQ) on Tuesday, emphasizing the collaborative efforts of national and international partners, including the U.S. Secret Service Ottawa Field Office and the Madrid Resident Office.
In response to the arrest, Desjardins expressed satisfaction and reaffirmed its cooperation with law enforcement authorities, underscoring its commitment to providing identity protection services to its members and clients.