The Conservative Party first became aware of the breach on Nov. 17 after personal financial records of 15 of its MPs were leaked.Nathan Denette/The Canadian Press
A data breach at Conservative Party headquarters involved more people than initially believed.
The party first became aware of the breach on Nov. 17, after the personal financial records of 15 members of Parliament were e-mailed to party insiders and others.
All except one of the MPs were elected for the first time in April.
The subsequent internal investigation revealed records belonging to other nomination candidates – not just those who ultimately became MPs – were also downloaded.
Those whose information was obtained were notified by the party last week.
Conservative MPs’ financial records leaked in alleged breach of party data
“The application package you submitted in connection with applying to be a candidate was downloaded by an unknown person(s) without authorization,” an e-mail from the party read.
A copy of the e-mail was obtained by The Globe and Mail.
One of the individuals who received the e-mail was Tracy Pepe.
She had applied to run for the party in Brampton Centre for the last election, though ultimately withdrew her nomination.
Ms. Pepe told The Globe she doesn’t understand why the party kept her information and is concerned they aren’t being forthcoming enough about the scope of the breach and next steps.
“My main issues are simple. Where is the transparency from a ‘law-and-order’ party that claims to protect democracy and build trust, yet does not demonstrate those values in its actions – especially toward the people who step forward to run for office?” she said.
Ms. Pepe said she’s not just worried about her own information being compromised, but also that of people who signed her nomination papers as their names and contact information were included in her nomination package.
“I also have no clarity on what will happen next or how the party plans to improve its standards,” she said.
Cyberattack targeting federal government gains access to individuals’ contact information
Conservative Party spokesperson Sarah Fischer said the party continues to investigate but declined to say how many were involved. The Globe is aware of at least six others, besides Ms. Pepe.
“We are treating this incident with the utmost urgency and have informed the RCMP, the Ottawa Police and the Canadian Centre for Cyber Security, who are conducting co-ordinated investigations,” Ms. Fischer said in a statement.
“We are offering online credit monitoring and identity restoration services to anyone affected or potentially affected.”
The Ottawa Police referred inquires to the RCMP, which did not return a request for comment.
Ms. Fischer said there is no sign the breach involved foreign interference.
In the notification to Ms. Pepe and others, the party said their information does not appear to have been circulated like that belonging to the MPs.
Those records were sent to people with long-time connections to the party, and also obtained by The Globe.
The sender used the named “Rory McTory,” a placeholder used by the party for years for website templates, information packages and other documents.
The sender circulated the MPs’ financial histories, including their debt levels and credit scores.
Among those whose records were sent around was Jamil Jivani, first elected to the House of Commons in a by-election in 2024 and re-elected in the spring.
He posted a video to his social media accounts saying “scumbags and weirdos” were using his financial past to make him afraid.
“I’m not,” he said in the video.
The Office of the Privacy Commissioner said they are aware of the breach, but cannot act: Political parties are not subject to the federal Privacy Act or the Personal Information Protection and Electronic Documents Act.
Last year, however, a B.C. court ruled that political parties are subject to the investigative powers of that province’s privacy commissioner.
The Liberals, Conservatives and NDP are appealing.
Mark Carney’s government is also trying to legislate an exemption for political parties from provincial privacy laws, tacking clauses to that effect into a recent affordability bill.
The bill has yet to become law.