Elections Alberta and Government of Alberta: Alberta premier calls for accountability as separatist group faces voter list investigations

Alberta Voter Data Breach Exposes Nearly 3 Million Records in Separatist Group Leak

Alberta Premier Danielle Smith has demanded legal accountability after a separatist group, the Centurion Project, allegedly obtained and published the province’s voter list online, exposing the personal information of nearly 2.9 million Albertans. The breach came to light in an Edmonton courtroom on Thursday, prompting investigations by Elections Alberta and the RCMP.

The voter list a dataset containing names and addresses was originally provided to the Republican Party of Alberta under strict legislative controls. However, the Centurion Project reportedly acquired it through a third party, converting it into a searchable app to identify and recruit supporters ahead of a potential separatist referendum this fall. After Elections Alberta secured a court injunction, the data was removed from the group’s website.

While the Elections Act restricts voter list distribution to political parties and officials, Alberta’s privacy laws currently exclude political parties from oversight, leaving a gap in protections. Privacy Commissioner Diane McLeod warned that the breach poses a "real risk of significant harm" to affected individuals and renewed calls for legislative reforms to bring political parties under the Personal Information and Privacy Act (PIPA) a change her office has advocated for decades.

The United Conservative Party government has withheld further comment pending the outcome of the investigations, which will focus on how the data was transferred to the Centurion Project. Smith, currently on a trade mission in the UK, has not provided additional remarks.

Source: https://www.cbc.ca/news/canada/edmonton/alberta-premier-calls-for-accountability-as-separatist-group-faces-voter-list-investigations-9.7184419

Government of Alberta cybersecurity rating report: https://www.rankiteo.com/company/government-of-alberta

Elections Alberta cybersecurity rating report: https://www.rankiteo.com/company/electionsab

"id": "GOVELE1777661104",
"linkid": "government-of-alberta, electionsab",
"type": "Breach",
"date": "5/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '2.9 million Albertans',
                        'industry': 'Public Sector',
                        'location': 'Alberta, Canada',
                        'name': 'Government of Alberta',
                        'type': 'Government'}],
 'attack_vector': 'Third-party acquisition',
 'data_breach': {'number_of_records_exposed': '2.9 million',
                 'personally_identifiable_information': 'Names and addresses',
                 'sensitivity_of_data': 'Personally identifiable information '
                                        '(PII)',
                 'type_of_data_compromised': 'Voter list (names and '
                                             'addresses)'},
 'date_publicly_disclosed': 'Thursday',
 'description': 'Alberta Premier Danielle Smith has demanded legal '
                'accountability after a separatist group, the Centurion '
                'Project, allegedly obtained and published the province’s '
                'voter list online, exposing the personal information of '
                'nearly 2.9 million Albertans. The breach came to light in an '
                'Edmonton courtroom on Thursday, prompting investigations by '
                'Elections Alberta and the RCMP.',
 'impact': {'brand_reputation_impact': 'Significant harm risk to affected '
                                       'individuals',
            'data_compromised': 'Names and addresses of nearly 2.9 million '
                                'Albertans',
            'identity_theft_risk': 'Real risk of significant harm',
            'legal_liabilities': 'Potential under Elections Act and privacy '
                                 'laws'},
 'investigation_status': 'Ongoing',
 'lessons_learned': 'Need for legislative reforms to include political parties '
                    'under privacy laws',
 'motivation': 'Recruitment for separatist referendum',
 'post_incident_analysis': {'corrective_actions': 'Legislative reforms to '
                                                  'include political parties '
                                                  'under PIPA',
                            'root_causes': 'Legislative gap in privacy '
                                           'protections for political parties'},
 'recommendations': 'Bring political parties under the Personal Information '
                    'and Privacy Act (PIPA)',
 'references': [{'source': 'Elections Alberta'},
                {'source': 'RCMP'},
                {'source': 'Privacy Commissioner Diane McLeod'}],
 'regulatory_compliance': {'legal_actions': 'Investigations ongoing',
                           'regulations_violated': ['Elections Act',
                                                    'Potential Personal '
                                                    'Information and Privacy '
                                                    'Act (PIPA) gap']},
 'response': {'containment_measures': 'Court injunction to remove data from '
                                      'the group’s website',
              'law_enforcement_notified': 'RCMP'},
 'threat_actor': 'Centurion Project',
 'title': 'Alberta Voter Data Breach Exposes Nearly 3 Million Records in '
          'Separatist Group Leak',
 'type': 'Data Breach',
 'vulnerability_exploited': 'Legislative gap in privacy protections for '
                            'political parties'}