2.9 Million Albertans Had Their Data Stolen: Here’s What Really Happened
How a separatist organization’s data breach exposed nearly 3 million Albertans, and what the chain of custody actually shows.
2.9 Million Albertans Had Their Data Stolen: Here’s What Really Happened
The Sanity Project · Bo Kauffmann
Two point nine million. That’s how many Albertans had their names, home addresses, phone numbers, and unique elector IDs published online this spring, courtesy of a separatist organization calling itself the Centurion Project. Not leaked by accident. Published. Searchable. Sitting on the open internet long enough for hundreds of people to look up their neighbours by name, whether or not those neighbours had any interest in Alberta’s independence movement.
Key Takeaways
The Centurion Project published the personal data of 2.9 million registered Alberta voters online.
Elections Alberta obtained an emergency court injunction on April 30, 2026, after the database had been live for weeks.
The RCMP, the provincial Privacy Commissioner, and Elections Alberta are all investigating simultaneously.
David Parker, the group’s leader, is not cooperating with any of them.
A Breach That Reached Every Corner of Alberta
Key Insight: The Centurion Project didn’t misuse a handful of records. It published the personal data of every registered voter in the province, most of whom had no connection to the group’s cause at all.
If you’re wondering how an entire province’s voter list ends up as a public lookup tool, the answer involves exactly one legal step and several illegal ones. It’s a shorter list than you’d expect.
How the Voter List Reached the Centurion Project
Key Insight: One authorized handoff, then several unauthorized ones. That’s the entire chain connecting a routine data transfer to a public leak of 2.9 million records.
The Legal Handoff
Under the Elections Act, Elections Alberta is permitted to give the voter roll to registered political parties for narrow, specific purposes: identifying supporters, organizing volunteers, running the ordinary mechanics of a campaign. The Republican Party of Alberta received its copy exactly the way it was supposed to. That’s where the legitimate chain of custody ends.
The Illegal Leak
Somewhere between that authorized handoff and this spring, a copy reached David Parker’s Centurion Project, an organization with no legal standing to possess the list, let alone publish it. And that’s exactly what happened. The Guardian first reported that the database had gone live, fully searchable, exposing every one of Alberta’s 2.9 million registered voters. Elections Alberta didn’t sit on it: Chief Electoral Officer Gordon McClure issued a cease-and-desist around April 27, and three days later, on April 30, 2026, the Court of King’s Bench granted an emergency injunction ordering the database taken offline.
The Investigation, By the Numbers
Key Insight: Three separate investigations are now examining a breach that, by Elections Alberta’s own count, touched hundreds of people directly and possibly thousands more.
Here’s where the numbers get uncomfortable. Elections Alberta says 21 people were handed complete copies of the full list. Another 545 accessed the database directly while it was still live. The agency has since issued 568 cease-and-desist letters, and officials admit thousands more may have viewed the data before anyone managed to pull the plug. Nobody, including Elections Alberta, can say with certainty how many copies of that list still exist, on how many devices, in how many hands, right now.
“Elections Alberta sent 568 cease-and-desist letters after a
party-only voter list became a public directory.”
David Parker’s response has been mostly silence. He’s declined to cooperate with investigators trying to establish who saw the list and what happened to Centurion’s own copies. This isn’t new territory for him: he faced similar scrutiny in 2023 over undisclosed advertising tied to his other group, Take Back Alberta, and used roughly the same playbook then, cast himself as the target of government persecution, and waited for the story to move on. Whether that works twice, with an active RCMP file and a class action attached, is a different question.
Get the next update on the Centurion Project investigation
before it hits the news cycle.
Subscribe to The Sanity Project
The People This Actually Endangers
Key Insight: For most Albertans, this breach is an inconvenience. For domestic violence survivors, police officers, and judges on that list, it’s a live safety risk.
The breach didn’t just expose casual voters who can shrug and change a phone number. It exposed domestic violence survivors whose home addresses are now searchable by anyone, including, potentially, the people they fled. It exposed police officers, judges, and journalists, people whose personal safety depends in part on their address not being one search away from a stranger. For a meaningful subset of the 2.9 million people on that list, this isn’t a hypothetical inconvenience. It’s a live risk, and it stays live for as long as copies of that database continue to circulate.
What a Data Breach Says About a Movement
Key Insight: The organization at the center of this breach has an explicit stake in Alberta’s independence referendum succeeding, which makes the breach more than a routine failure of data hygiene.
The Centurion Project didn’t build this database by accident. By its own account, it exists to identify and organize Albertans who might support a future independence vote. A proposed class action now names the Alberta government, Elections Alberta, the Republican Party of Alberta, the Centurion Project, and David Parker personally, as well as the vulnerable Albertans the breach exposed.
“The Centurion Project says it exists to find independence supporters,
using data millions never agreed to share.”
Sovereignty movements talk a great deal about accountability, about restoring control to ordinary people. It’s a reasonable pitch, in the abstract. But an organization that couldn’t be bothered to protect the basic personal information of the people it claims to represent is not a promising preview of how it would handle actual governing power. If this is what happens before the referendum, it’s worth remembering before anyone signs anything else.
Follow The Sanity Project for ongoing, fact-checked coverage of the breach investigations and Alberta’s separation fight as they move through the courts.