Did a family’s Desjardins data make it into the hands of this ‘prolific’ Toronto fraudster?

As Quebec police continue to investigate the massive Desjardins security breach, one family who banks with the credit union is wondering whether their personal information may have made it into the hands of a Toronto woman that police have described as a “professional” and “prolific” fraudster.

Five members of one family near Kapuskasing, Ont., about 800 kilometres north of Toronto, have filed numerous police reports after someone took out thousands of dollars in loans, credit cards and purchased a car — all using the identity of a 26-year-old female family member.

“She’s going to be stuck with this the rest of her life. She’s going to have to monitor her credit for the rest of her life. She’s even thought of changing her name. It’s life-changing,” said the woman’s mother, speaking about the bills racked up in her daughter’s name.

“We were wondering who can do that? What do they look like? How do they pass for her?”

The family has asked to not be identified, due to the privacy breaches they’ve already suffered and the fact no arrests have been made. They provided CBC News with dozens of documents outlining the apparent identity theft.

The whole family banks with Desjardins and were notified in June that each of their personal information had been stolen as part of a data breach affecting all 4.2 million members of the Quebec-based credit union — considered to be one of the largest corporate data thefts in Canadian history.

That same month, a series of loans and purchases were made by someone using the daughter’s identity.

Condo address as link?

The family reached out to CBC News after our investigation last month revealed that a Toronto woman named Deborah Oguntoyinbo is facing more than 50 fraud-related charges, allegedly involving the stolen identities of some 20 women.

She was previously living in a 22nd-floor condo unit at 50 Forest Manor Rd. in Toronto.

The northern Ontario family says they’ve learned that whoever stole their daughter’s identity fraudulently purchased auto insurance in her name using the same Toronto condo address.

CBC has also since uncovered information that shows Oguntoyinbo rented the condo using an identity stolen from yet another woman.

Oguntoyinbo has been convicted of more than a dozen fraud-related charges and is currently facing more than 50 additional charges in Toronto, as well as in the nearby York, Peel and Halton regions.

It’s alleged she’s stolen the identities of some 20 women, draining their bank accounts and leasing homes and cars in their names. In many cases, the alleged victims’ credit ratings have been destroyed.

Last June, police executed a search warrant at the Forest Manor condo. Among the items police say they seized: printers, card stock, drivers’ licences, social insurance numbers and passports in the name of multiple individuals.

The condo address was provided to the family after they started getting calls from collection agencies, hounding them for unpaid bills supposedly racked up in the Kapuskasing woman’s name.

One unpaid bill included a Sonnet car insurance policy for a vehicle purchased in the daughter’s name. The family said they were told that the policyholder used that 22nd floor condo unit as their address on two separate occasions.

“We just put two and two together and said, ‘Wow,'” said the woman’s mother.

“It was a relief, because at least [police] have something to look at,” she said, referring to the address. “I hope that all the work and all the research we did pays off to help try and find whoever did this.”

York Regional Police, a jurisdiction located just north of Toronto, is investigating the Kapuskasing woman’s case, as that’s where some of the alleged frauds may have occurred.

Among the loans being probed is a $36,131 car bought in the 26-year-old’s name in June.

“While this is going on, we know, certainly, there is the potential for more victims. We want to encourage those people to feel comfortable to come forward and report what occurred,” said York Regional Police Const. Laura Nicolle.

What’s known about the Forest Manor condo

Oguntoyinbo lived at the Forest Manor condo for about seven months, CBC News has learned. She and her partner, Jose Manuel Godinez, moved in with their two young kids about a week before Christmas 2018.

CBC reached out to the condo’s landlord, who declined to be interviewed.

But it appears neither Oguntoyinbo, nor her partner provided real names when renting the condo; they allegedly used the names Mervia Donaldson and Alex Lopez on their lease.

They presented a credit background check and letters of employment, which turned out to be fake.

Sometime after police raided the condo in June, the couple moved out.

In an attempt to piece together their movements, CBC News reached out to Mervia Donaldson, a financial planner from a suburb outside Toronto.

Donaldson confirmed her identity had been stolen months earlier, and that someone had tried to take out an American Express credit card in her name.

She had no idea her name had also been used to rent the Forest Manor condo until contacted by CBC.

But she said someone had used her name to rent another condo in the fall of 2018, which only learned in January 2019, when a landlord in Brampton, Ont., contacted her, looking for three months of unpaid rent.

“She wanted to sue me,” said Donaldson.

The landlord sent Donaldson a picture of the driver’s licence used to rent the home. It appears to show Oguntoyinbo.

The landlord also had a forged letter of employment, supposedly written by Donaldson’s supervisor.

“I still don’t know how it happened,” Donaldson said about her stolen identity. She is not a Desjardins client and has never lost her identification.

Donaldson said she reported the situation to police, but that they didn’t investigate.

What’s known about Oguntoyinbo and Godinez

Oguntoyinbo is currently behind bars, awaiting trial for fraud-related charges in the four GTA jurisdictions. Police in Longueuil, Que., also have two warrants out for her arrest related to alleged identity theft.

“She definitely would be considered a professional fraudster, knows what she’s doing and [is] quite prolific,” York Regional Police Sgt. Andy Pattenden previously told CBC.

As for her partner, Godinez, 27, also has at least 10 criminal convictions.

In January 2019, he was charged by Toronto police for possessing a stolen vehicle. He was released on conditions. Less than a month later, he and Oguntoyinbo were both arrested by police in Halton and accused of a series of other frauds.

Desjardins responds

It’s unclear how many — if any — of Oguntoyinbo’s alleged victims are Desjardins clients.

CBC News could not locate most of them; many appear to have changed their phone numbers, shut down social media accounts and reduced their online footprints. Calls to some of their homes went unreturned.

Desjardins said while it can’t discuss specific cases due to privacy concerns, the credit union said it isn’t the only company to have customer information compromised in recent years.

“We don’t want to diminish what happened, but according to the Office of the Privacy Commissioner of Canada, more than 680 privacy breaches have been reported in Canada in the last year,” said Desjardins spokesperson Chantal Corbeil.

“According to these reports, well over 28 million Canadians have been affected in the past 12 months, making privacy breaches a pandemic that extends well beyond Desjardins.”

An October report from the Office of the Privacy Commissioner of Canada confirms that statement.

The figures were disclosed after Canadian companies were mandated to report data breaches in 2018. Previously, reporting such breaches was voluntary for most corporations.

“Since reporting became mandatory, we’ve seen the number of data breach reports skyrocket,” reads the OPCC report. “Some of those reports have involved well-known corporate names, but we have also seen significant volumes coming from small- and medium-sized businesses.”

CBC