Canadian lender Desjardins Group said on Thursday an unauthorized use of internal data by an employee led to breach of personal information including social insurance number, address and details of banking habits of more than 2.9 million members.