The illegal use of voter information by rightwing separatists in the province of Alberta has raised fresh fears over Canada’s electoral integrity by making valuable and “incredibly confidential” personal data easily accessible to malicious actors, security experts have warned.

The data breach, one of the largest in Canadian history, has prompted warnings of a “truly terrifying” new battleground over information, persuasion and foreign interference in already weakened democratic systems.

Activists in the oil-rich province have in recent months increased their effort to force an independence referendum. But debates over secession – already rife with accusations of treason and internecine feuding – have been overshadowed by revelations that a separatist-linked organization gained illegal access to Alberta’s official list of electors. The database contains the names, home addresses and contact information for roughly 2.9 million voters.

Elections Alberta, the body that administers the vote in the province, says it has launched an investigation into how a far-right group was able to access the database and use it for a campaign to reach voters.

Separatist leaders recently unveiled an initiative using data-driven campaigning and grassroots mobilization to connect with voters.

During an online meeting with supporters, the Centurion Project organizer Emmott Kelsey told attenders the app would “revolutionize” how campaigns are run. He boasted that the software underpinning it was “so groundbreaking” that it had been presented to Donald Trump’s White House.

“And we’re kind of the guinea pigs with it,” he said. The Guardian asked Kelsey to clarify his remarks but did not receive a response.

One of the key figures of the Centurion Project is David Parker, a veteran Alberta political organizer with deep ties to the separatist movement, and to US Maga activists and far-right figures such as Tucker Carlson. Parker has previously faced hefty fines from Elections Alberta over violations of voting laws.

“Parker is a shockingly effective political organizer. What he was doing was attempting to create a digital grassroots organizational tool. And on its face, there’s nothing wrong with that,” said Jen Gerson, an Alberta-based journalist. “But in order to populate the app that underlies the Centurion Project, he needed data.”

In March, Gerson was tipped off that the Centurion Project had obtained a copy of the province’s voter list. Her source said they had been able to access the Centurion Project’s database without using their real name or any traceable personal information.

Gerson said the absence of any security or protection was astounding.

“Anybody with a burner account and no credentials could then access the file and potentially download information from it,” she said. “If you knew about it, you could anonymously access the entire data root file.”

Gerson reported her concerns to Elections Alberta in late March. But the oversight body responded that while her report was “compelling”, Parker could have obtained the list legally from a data broker and concluded there were “no reasonable grounds” to investigate.

A month later, however, EA obtained a court order to shut the database down and launched an investigation. Canada’s federal police, the RCMP, and Alberta privacy commissioner are also investigating the breach.

In order to prevent the improper sharing of voter lists, EA “seeds” voter lists with fake names, and the body was able to confirm that the CP list had originally been provided legally to the Republican party of Alberta, a fringe rightwing party, and then improperly shared.

The party said it had told Centurion Project not to use the data but did not say if the list had come from within the party. “We were proactive on that before the injunction today, and we’ll be fully complying with Elections Alberta,” leader Cam Davies told the Canadian Press.

The provincial government has blamed the elections agency for failing to investigate the breach when first notified. But EA says the provincial government weakened its investigative powers last year.

Elections Alberta says nearly 600 people accessed the voter list which it described as “incredibly confidential”, adding in a statement that it understood Albertans were “unhappy, scared and anxious” about the situation.

“We have heard countless stories about the risks people face having their information made public, including stories from domestic violence survivors, law enforcement, marginalized communities, and more,” the group said, calling on the government to amend existing laws to prevent a similar breach in the future.

Parker has denied that he used the Republican party voter list and suggested the database was compiled from a third party.

“We have taken action to shut down the app until we can ensure that the dataset is compliant with Alberta and Federal privacy laws. The Centurion Project plans to fully comply with Elections Alberta’s investigation,” Parker said in a statement.

In the statement, Parker said volunteers with the Centurion Project “did not have access to phone numbers or emails” and the dataset was from a third party.

But during an online demonstration of the database for volunteers at a 16 April event , Parker showed how the personal information of any voter could be found on the database. One witness at the event – a member of the opposition NDP – was shocked when Parker pulled up the home address and phone number of Alberta’s former premier Jason Kenney. That witness then filed a report with the police.

Kenney has said he is hiring a lawyer for advice, warning that the breach may affect domestic violence survivors, journalists, activists, judges and other public servants for years to come.

“This has been a real wake-up call to the risks that we’re playing with here. We have to assume that all of our personal information and address are potentially available to bad actors,” said Gerson. “People are very angry and they’re very scared. But if you don’t want these guys in your house, why are you even thinking about letting them run your country?”

The leak has become a political flashpoint in Alberta, but the efforts to subvert election and privacy laws expose the immense value in voter lists and mirror a similar battle unfolding in the US.

In recent months, the US Department of Justice has sued 30 states and the District of Columbia for failing to turn over full copies of their voter registration lists. States, including some controlled by Republicans, have resisted, citing constitutionally guaranteed authority over election administration and worries over data security and privacy laws. Voting rights groups have sued the Trump administration over the requests for voter rolls, accusing it of laying the groundwork for voter purges ahead of the November midterms.

“Data is a major force in modern politics, especially in the ways it can be leveraged. Powerful actors and authoritarian regimes are very creative and have real designs on taking apart the last remaining liberal democracy in North America,” said Patrick Lennox, former manager of criminal intelligence for the RCMP’s federal policing programs in Alberta. “Since Trump came back into power, he has destabilized that democracy to the point where I don’t think you can legitimately call it a democracy any more … And I worry that’s exactly what the play is in Alberta.”

The Centurion Project has not said which company developed the underlying software it relies on, but sources familiar with the investigation say the company is based in the United States. When asked for comment by the Guardian, the company did not respond.

Lennox warned that if the file was stored without proper protections, it could be captured by American data brokers who are governed by less stringent privacy laws than in Canada. The breach also comes as the Trump administration has threatened to subjugate Canada and signalled its support for Alberta’s separatists.

“It’s not like the Americans will put in digital sovereignty precautions for the voter list,” he said. “Because it’s important to remember: the United States is also trying to break our country.”

Washington is not the only outside actor paying close attention to Alberta’s secession movement. Researchers recently warned that the province is being targeted by covert influence campaigns run by countries such as Russia and China. The Global Centre for Democratic Resilience, the University of Regina and DisinfoWatch recently documented the scope of foreign interference campaigns alongside the proliferation of AI-generated videos and the threat over threats and interference from Trump and his allies.

Brian McQuinn, co-director of the Centre for Artificial Intelligence, Data, and Conflict at the University of Regina pointed out that before Russia’s full-scale invasion of Ukraine, researchers documented a spike in discussions about sovereignty in the country.

“There was this narrative that it was not actually its own sovereign country, that it’s just this sort of mistake of history. This is the exact same language the Americans are using around Canada,” he said.

Covert meetings between separatist activists in the Canadian province of Alberta and members of Trump’s administration have already roiled the province.

“The Americans would like us to be as weak as possible – and a separation movement that harms us in negotiations is obviously really important,” said McQuinn. “They are advancing their own interests around this, when it comes to trade, when it just comes to weakening us in any way they can.”