Full Report
A data breach involving The Centurion Project was reported in April 2026. See incident details, impact on customers, and recommended security measures.
Analysis Summary
# Incident Report: The Centurion Project Voter Data Exposure
## Executive Summary
In April 2026, The Centurion Project, an Alberta-based political organization, was identified as the source of a significant data exposure involving a database containing confidential voter information for approximately three million Albertans. The breach, attributed to either a database misconfiguration or unauthorized access, exposed sensitive identifiers, leading to investigations by Elections Alberta and the RCMP. The primary outcome was a court-ordered shutdown of the database and a mandate for the organization to identify all parties who accessed the exposed records.
## Incident Details
- **Discovery Date:** April 30, 2026
- **Incident Date:** Reported April 30, 2026 (Originating from data acquired in 2025)
- **Affected Organization:** The Centurion Project (thecenturionproject[.]ca)
- **Sector:** Political/Non-profit
- **Geography:** Alberta, Canada
## Timeline of Events
### Initial Access
- **Date/Time:** Approximately April 2026 (Reporting date)
- **Vector:** Probable Database Misconfiguration
- **Details:** A database containing sensitive voter lists was allegedly left accessible to the public internet without adequate authentication.
### Lateral Movement
- **Details:** Not applicable/Not disclosed. The incident appears to be a direct exposure of a storage asset rather than a multi-stage network intrusion.
### Data Exfiltration/Impact
- **Details:** Confidential information for up to 3,000,000 individuals was compromised. The data included voter list information (names, addresses, and other identifiers) originally provided to the Republican Party of Alberta in 2025.
### Detection & Response
- **Detection:** The exposure was identified and reported to authorities, triggering immediate investigations by Elections Alberta and the RCMP.
- **Response:** A court injunction was successfully obtained to terminate public access to the database. The Centurion Project was legally ordered to identify all individuals who had accessed the data during the period of exposure.
## Attack Methodology
- **Initial Access:** Misconfigured database/Publicly accessible cloud storage.
- **Persistence:** Not applicable; access was maintained via the open nature of the database.
- **Privilege Escalation:** None required due to lack of access controls.
- **Defense Evasion:** Not applicable.
- **Credential Access:** None required if the database was unauthenticated.
- **Discovery:** External scanning by third parties or security researchers.
- **Lateral Movement:** Not applicable.
- **Collection:** Automated scraping of the exposed database records.
- **Exfiltration:** Unauthorized download of voter lists by unknown third parties.
- **Impact:** Exposure of PII (Personally Identifiable Information) for approximately 7.5% of the Canadian population.
## Impact Assessment
- **Financial:** Potential for significant legal fees and regulatory fines from Elections Alberta.
- **Data Breach:** Exposure of names, addresses, and voter identifiers for 3 million individuals.
- **Operational:** Legal injunction forced the shutdown of the organization's database operations.
- **Reputational:** Medium-to-high; significant loss of trust regarding the handling of sensitive political data.
## Indicators of Compromise
- **Network indicators:** thecenturionproject[.]ca
- **File indicators:** Confidential voter list exports (2025 dataset).
- **Behavioral indicators:** Unusual traffic volume to database ports/endpoints from unauthorized IP addresses.
## Response Actions
- **Containment:** Public access to the database was terminated via court order.
- **Eradication:** Investigation into the source of the data leak and audit of database permissions.
- **Recovery:** Identification of all parties who accessed the data and ongoing cooperation with law enforcement (RCMP).
## Lessons Learned
- **Key Takeaways:** Political organizations handle highly sensitive PII that requires the same level of security as financial or healthcare data.
- **What could have been done better:** Implementation of strict access control lists (ACLs) and regular audits of cloud-hosted databases could have prevented the public exposure.
## Recommendations
- **Database Hardening:** Ensure all databases require strong authentication and are not accessible from the public internet (Zero Trust architecture).
- **Attack Surface Management:** Deploy continuous monitoring tools to detect misconfigured cloud storage or exposed digital assets in real-time.
- **MFA Implementation:** Enforce phishing-resistant Multi-Factor Authentication for all administrative access to sensitive data repositories.
- **Data Minimization:** Regularly purge or archive sensitive voter data that is no longer required for immediate operations.