Juan Pablo Serrano, wanted since June 2024 in connection with the Desjardins data breach, was arrested in Spain, according to a news release published Tuesday by Quebec provincial police.

Serrano was arrested on the evening of Nov. 6, 2025 thanks to a joint operation between Spanish authorities, provincial police and Interpol, according to the release.

He was among the most wanted fugitives in Quebec. To locate Serrano abroad, provincial police say Interpol issued a Red Notice — a request to law enforcement worldwide to locate and arrest someone pending extradition.

Serrano is currently detained in Spain, and upon his extradition to Canada will face three charges: identity theft, fraud exceeding $5,000 and trafficking in identity information.

In June 2024, provincial police posted information about the 40-year-old fugutive online, saying he allegedly purchased Desjardins members and customers data lists through Sébastien Boulanger-Dorval and executed various fraud schemes with Desjardins data.

Boulanger-Dorval, 42, was arrested charged with fraud, identity theft and the illegal possession and sale of personal information, along with using a computer for fraud.

Boulanger-Dorval was the primary suspect in investigation. He worked at Desjardins on a marketing team at the time of the breach and allegedly sold the leaked data to pay debts.

WATCH | In 2024, we looked at whether your banking data was more protected:

Is your banking data any safer 5 years after the Desjardins breach?

Financial institutions have added more safeguards over the years. While experts say your information will always be at risk, there are steps you can take to protect yourself.