Quebec provincial police say a key suspect linked to the massive Desjardins data breach affecting millions of members has been arrested in Spain following an international police operation.

Authorities allege Juan Pablo Serrano, 40, was involved in the theft and resale of personal information belonging to approximately 9.7 million Desjardins members. Investigators say the data was originally obtained from a former employee of the Quebec-based financial institution and later used in a range of fraud schemes.

Serrano, a Canadian citizen of Ecuadorian descent, had been sought by police since June 2024 and was listed among Quebec’s most wanted fugitives. He was taken into custody on Nov. 6, 2025, during a coordinated effort involving Spanish police, the Sûreté du Québec and Interpol.

Police say Serrano remains detained in Spain as extradition proceedings continue. If returned to Quebec, he is expected to face multiple charges, including fraud over $5,000, identity theft and trafficking in identifying information.

The Desjardins data breach, first revealed in 2019, remains one of the largest privacy breaches in Canadian history and has prompted ongoing scrutiny of data protection practices in the financial sector.