January 6, 2026 l Dalena Reporters
MONTREAL — Juan Pablo Serrano, a 40-year-old Canadian fugitive long sought by Quebec authorities for his alleged role in one of the country’s largest financial data breaches, was arrested in Spain after evading police for more than a year. The arrest was carried out on November 6, 2025, but was publicly confirmed by the Sûreté du Québec (SQ) in a news release on January 6, 2026, highlighting the extensive international cooperation that brought him into custody.
Serrano had been on the run since June 2024, wanted in connection with the notorious Desjardins Group data leak that exposed the personal information of nearly 9.7 million clients of Canada’s largest credit union. Police allege he purchased the stolen data from a former Desjardins employee and used it to carry out a range of fraud schemes, according to Quebec provincial police.
The joint operation involved Spanish law enforcement, SQ investigators and Interpol, which had issued a Red Notice a global request for police assistance in locating and detaining Serrano pending extradition. The coordinated effort also included contributions from the U.S. Secret Service Ottawa Field Office and its Madrid Resident Office, which authorities credited as “instrumental” in the capture.
Serrano, a Canadian citizen of Ecuadorian descent, remains in custody in Spain while formal extradition proceedings are underway. Once returned to Canada, he is expected to face multiple charges in Quebec, including fraud over $5,000, identity theft and trafficking in identity information.
The Desjardins breach, first revealed in 2019, has been described as one of the most significant privacy violations in Canadian history. The leaked information spanning a period of more than two years before the credit union became aware of the security failure included personal data for millions of Canadians and international clients, triggering widespread concerns about data protection and cybersecurity practices within major financial institutions.
Earlier phases of the investigation saw five other suspects arrested in June 2024, including the alleged mastermind, Sébastien Boulanger-Dorval, a former Desjardins employee accused of selling the data. Arrests tied to the case have taken place over several years, with some suspects apprehended as far back as 2018 and 2019 in related fraud incidents.
Privacy authorities in Canada have previously issued scathing reports criticizing Desjardins for failing to adequately safeguard member information, concluding that the institution was aware of vulnerabilities but did not address them in time to prevent the breach. The fallout has prompted regulatory scrutiny and heightened calls for stronger data protection regimes across the financial sector.
Serrano’s arrest marks a significant development in a high-profile saga that has underscored the growing threat of insider data theft and the complex challenges of prosecuting transnational cyber-enabled financial crimes.