The personal information of 2.9 million Albertans — including names, addresses and in some cases phone numbers — was published publicly on a website by the Centurion Project Ltd., a third-party organization that obtained Alberta’s list of electors without authorization.
Elections Alberta confirmed the breach on April 30 and obtained an emergency court injunction the same day barring the Centurion Project from accessing or using the data.
Alberta RCMP have since launched an investigation and are working with other law enforcement partners to determine whether any offences were committed in the dissemination or handling of the voter list. RCMP have confirmed the investigation was triggered in part by correspondence from an individual associated with the Alberta NDP who raised concerns about potential misuse of the list.
“More than 2.9 million Albertans have had their personal information breached,” said Information and Privacy Commissioner Diane McLeod. “For some of these individuals there is likely a real risk of significant harm given that their home address and phone numbers have been made public. This could be especially harmful for certain individuals. Some examples might be those who work for law enforcement, who are public officials, who are fleeing intimate partner violence and other vulnerable individuals.”
About the Centurion Project
The Centurion Project website currently shows no information.
According to CBC News, the Centurion Project describes itself as “a company that was established to help train volunteers on how to be better citizens and to impact the political process,” adding that its app “is strictly used by volunteers to find people they personally know in a database.”
The group says volunteers “are not given access to any phone numbers or emails and are encouraged only to contact and claim people they already know.”
The Centurion Project said it relied on a third party to provide the dataset used in its tool. It has since shut down the app and says it intends to fully comply with Elections Alberta’s investigation.
How it happened
The list of electors was originally provided to the Republican Party of Alberta as a registered political party legally entitled to receive it. Elections Alberta says the data was then accessed by the Centurion Project — a third party with no legal right to the list — and published on its website.
Elections Alberta obtained credible information about the breach on April 27 and Chief Electoral Officer Gordon McClure issued a cease-and-desist order to the Centurion Project on April 28. When that directive went unheeded, Elections Alberta representatives attended a Centurion Project meeting in Edmonton on April 29, supported by Edmonton Police Service officers, to personally serve the order.
On the morning of April 30, Elections Alberta and legal counsel obtained an emergency injunction from the Court of King’s Bench. The order requires the Centurion Project Ltd. and the Republican Party of Alberta to identify everyone who received or accessed the list and provide that information to the chief electoral officer within four days.
Political response
The United Conservative Caucus acknowledged that caucus staff attended a Centurion Project meeting on April 16, more than 10 days before Elections Alberta says it obtained credible information about the breach.
“Caucus staff regularly attend events of political interest, including the meeting in question,” said Shanna Schulhauser, director of communications for the United Conservative Caucus.
“The organizers of this meeting were adamant that the data being used was obtained legally. At the same time, the staff observing the meeting had no reason to believe the website in question was unlawful.”
The caucus statement also directed criticism at the Alberta NDP, alleging that members of the Opposition, including the leader of the Opposition, may have suspected the list was illegal but did not bring that information forward to the government for several weeks.
“Perhaps instead of pointing fingers and playing politics the NDP should let these independent bodies [do] their job and investigate,” Schulhauser said.
Why Elections Alberta didn’t act sooner
McClure addressed public frustration about the timeline directly, pointing to legislation passed last year that significantly raised the bar for launching investigations.
Under Bill 54, passed by the legislature in 2025, Elections Alberta must now have “reasonable grounds to believe an offence has occurred” before it can begin investigating — a standard the chief electoral officer had warned against.
In a letter to all MLAs in May 2025, McClure cautioned that the higher threshold would mean “the onus will fall on a complainant to provide a substantively completed investigation in order for the election commissioner to look into a matter,” and that the changes would “eliminate the majority of the compliance activities undertaken by the election commissioner.”
“Elections Alberta can confirm that requiring ‘reasonable grounds’ in legislation has indeed impacted Albertans in this and other matters, as predicted in that letter,” McClure said.
A gap in Alberta’s privacy law
Commissioner McLeod flagged a significant legal gap exposed by the breach: Alberta’s Personal Information Protection Act does not apply to political parties, meaning the Office of the Information and Privacy Commissioner may have limited jurisdiction over how the Republican Party of Alberta handled the list.
“This is evidence of a concerning gap in Alberta’s privacy laws as it relates to the collection, use and disclosure of personal information by political parties,” McLeod said, noting her office has been calling for political parties to be made subject to PIPA for decades.
British Columbia’s substantially similar privacy legislation does apply to that province’s political parties. McLeod is again calling on the Alberta government to close the gap in the next round of amendments.
Impact on citizen initiative petitions
The breach has direct implications for ongoing citizen initiative petitions in Alberta.
As a security measure, each copy of the voter list provided by Elections Alberta is seeded with fake names before distribution. This allowed Elections Alberta to trace which copy of the list was leaked and to confirm the compromised copy came from the Republican Party of Alberta.
The agency has amended its verification process for all incoming petitions to check whether any seeded names from the compromised Republican Party of Alberta list appear on petition signature sheets.
Petitions affected include the Alberta independence referendum petition, the No New Coal Mining in the Eastern Slopes of the Rocky Mountains petition and two current recall petitions. The updated process will also apply to all future petitions.
Legislation governing citizen initiative petitions is separate from the voter list breach itself. Under current rules, Elections Alberta cannot confirm whether a specific individual’s name appears on a petition signature sheet or remove a name at that person’s request, even if the signature might have been added using compromised data.
What to watch for
Elections Alberta says Albertans should watch for warning signs of identity theft or misuse of personal data. These include unexpected mail or statements, missing bills or financial statements, unfamiliar accounts on credit reports, debt collection calls for unknown accounts and unsolicited emails or texts claiming to help recover personal information.
Legitimate organizations will never ask for sensitive personal information via email or text. Do not click links in unsolicited messages — go directly to the official website of the organization in question.
Setting up monitoring through your web browser, antivirus software and financial institution can help detect unusual activity early.
Anyone who believes their information has been misused or that they are a victim of identity theft should report it to local police immediately. Additional guidance is available through the Federal Privacy Commissioner and the Office of the Information and Privacy Commissioner of Alberta.
