Desjardins Group said the personal information of more than 2.9 million of its members has been shared with individuals outside of the organization in a “malevolent” act.

The Quebec-based financial institution said the situation is the result of unauthorized and illegal use of its internal data by an employee who has since been fired.

Desjardins noted the incident, which affected more than 40% of its members, was not the result of a cyber attack and that its computer systems were not breached.

Personal members may have had several pieces of information released including their name, date of birth, social insurance number, address, phone number, email address and details
about their banking habits. Passwords, security questions and personal identification numbers were not compromised, the organization said.

As a precaution, it said it is also offering to pay for a credit monitoring plan and identity theft insurance for 12 months for affected members. Customers affected financially by the breach will be reimbursed, executives said but declined to put a number on the potential cost to the organization.