Quebec provincial police announced Jan. 6, 2026, that Juan Pablo Serrano, wanted since June 2024 over the theft and resale of Desjardins members’ data, had been arrested in Spain on Nov. 6, 2025. He faces fraud, identity theft and trafficking charges in Quebec once extradition is complete.
One of Quebec’s most wanted, caught abroad
The Sûreté du Québec said Serrano, 40, was arrested on Nov. 6, 2025, in a joint operation involving Spanish police, Quebec provincial police and Interpol. A Canadian citizen of Ecuadorian descent, he had been sought since June 2024 and ranked among Quebec’s most wanted fugitives.
Police allege Serrano purchased stolen data from a former Desjardins employee and used it for various fraud schemes. He remains in custody in Spain while extradition proceedings play out, and once returned to Canada he faces several charges, including fraud over $5,000, identity theft and trafficking in identifying information.
The breach behind the manhunt
The Desjardins leak, uncovered in 2019, is one of the largest privacy breaches in Canadian history. The personal information of 9.7 million members and clients of the Quebec-based financial co-operative — names, addresses, social insurance numbers, banking habits and more — was taken by an employee in the institution’s marketing department, who exfiltrated the data over a period stretching from September 2018 to January 2019 before Desjardins discovered what was happening.
The fallout was enormous. Desjardins ultimately agreed in 2021 to a settlement of up to $200 million to compensate affected members, and the case became a landmark in Canadian debates over data protection, insider threats and what financial institutions owe the customers whose information they hold.
The wider police operation
Serrano was not the only name on the police list — and his arrest was not the first. Five other suspects had already been arrested in connection with the breach and the market for the stolen data, including Sébastien Boulanger-Dorval, described by police as the alleged mastermind of the scheme, along with François Baillargeon-Bouchard, Jean-Loup Masse-Leullier, Charles Bernier and Laurence Bernier.
Investigators believe the stolen profiles changed hands repeatedly, with buyers using them for identity theft and financial fraud — including, police allege, sales conducted on the dark web. Interpol’s Red Notice system helped track Serrano internationally once he left Canada.
What happens next
Serrano remains in Spanish custody while extradition proceedings run their course, a process that can take months. Under the allegations set out by Quebec police, he bought the stolen Desjardins data from the former employee in 2021 and resold it — including on the dark web — putting millions of people’s names, addresses, social insurance numbers and banking details into the hands of fraudsters.
For Desjardins members, the arrest changes little in practical terms: the institution has long since offered affected members credit monitoring and identity restoration support, and the compensation settlement was approved years ago. But for investigators, Serrano’s capture matters because the resale of the data — not just the original theft — is what turned a corporate data breach into years of individual fraud against ordinary account holders.
His arrest in Spain closes one of the longest-running threads of the investigation, nearly two years after the warrants were issued. What remains is the slower machinery of extradition, after which Serrano is expected to be returned to Quebec to face the charges in court.
