I've been looking into this recently Because Reasons. The story's pretty poor in most places.

Brian "Krebs on Security" Krebs wrote a bit in March 2018 on the state of bank online security. Virtually all of it is outsourced to a handful of major service providers: Fiserv, Jack Henry, FIS, CSI, and Finastra.

https://krebsonsecurity.com/2018/03/what-is-your-banks-secur...

I don't find any indication of what Desjardins' security is based on.

IME, It's very, very, very common for law enforcement to be the ones that first detect signs of a breach and track it back to the affected company, at banks and elsewhere.