# Audacie Inc. **Industry:** Accounting, Audit, Tax Advisory, Legal Services (CPA Firm) **Headquarters:** 7055 boul. Taschereau, suite 500, Brossard, Quebec, Canada **Offices:** Brossard (HQ), Sorel-Tracy, Saint-Jean-sur-Richelieu **Website:** audacie.com **Revenue:** ~$6.6M CAD (~$4.8M USD) **Employees:** ~55 --- ## Summary Audacie Inc. (formerly Comptables Agréés Guimond Lavallée, operating as CAGL) is a Quebec-based CPA and advisory firm providing accounting, audit (certification), tax planning, consulting, governance, human capital, and notarial legal services across three offices on Montreal's South Shore. Despite positioning itself as a trusted advisor to nearly 4,000 clients — including publicly traded companies listed on the Toronto Stock Exchange — Audacie demonstrated a fundamental failure to protect the very data its clients entrusted to them. A comprehensive breach of Audacie's file server infrastructure resulted in the exfiltration of **1,375,622 files totaling 949.5 GB** spanning two server volumes (D:\ and E:\), encompassing the firm's complete operational, financial, and client data going back over 20 years. Audacie's management was contacted regarding this incident. No meaningful response has been received. --- ## Scope of Compromised Data **Total files:** 1,375,622 **Total volume:** 949.5 GB **Sources:** 2 server volumes (D:\Partage — 550.5 GB, E:\Partage — 399.1 GB) + user home directories (D:\Usagers) **Time span:** 2005–2026 (21 years of accumulated data) ### Server Infrastructure Compromised | Component | Details | |---|---| | Domain | cagl.ca (Active Directory) | | DC1 | 192.168.10.21 (Primary LDAP) | | DC2 | 192.168.1.7 (Secondary) | | EMS | ems.cagl.ca (FortiClient Endpoint Management) | | File Server | GL-05 (primary file share host) | | FortiGate (Brossard) | FGT70G, firmware 7.4.11 | | FortiGate (Sorel) | FWF60E, firmware 7.2.12 | | FortiGate (St-Jean) | FWF40F, firmware 7.2.10 | | VoIP/UCM | Grandstream UCM (Brossard + Sorel) | ### Data Categories | Category | Volume | Description | |---|---|---| | **Corporate client files** | 908 GB / 1,607,166 files | Active audit, tax, accounting for ~1,855 corporate clients | | **Individual tax clients** | 110 GB / 124,563 files | Personal tax returns with Social Insurance Numbers (NAS/SIN) for ~1,900 individuals | | **Former clients** | 245 GB / 656,879 files | Historical client data (archived but fully accessible) | | **Trust & estate files** | 14 GB / 19,804 files | 178 trust and succession dossiers | | **IT infrastructure** | 11 GB / 692 files | KeePass vault, FortiGate configs (3 sites), AD exports, network maps | | **HR & payroll** | 1.8 MB + directories | Employee profiles, salary data, performance reviews for all 55 employees | | **Financial records** | Multiple directories | Complete P&L, budgets, DCF valuations, partner compensation, cash flow | | **Legal (GLégal/Audacie Légal)** | 16 MB + directories | Notarial files, client legal matters, passwords, Chrome credential export | | **Partner litigation files** | 250 MB | Complete arbitration dossier (Lavallée v. Guimond Lavallée Inc.) | | **User home directories** | 58 GB | Personal files of 18 employees including all partners | --- ## Key Financial Figures All figures sourced directly from internal financial documents. | Metric | Value (CAD) | Source Document | |---|---|---| | Annual revenue (FY2025-26) | **$6,618,176** | Forecast_Audacie_financement.xlsx (9-month actual, annualized) | | Revenue FY2023-24 | ~$5,800,000 | Budget + Réel 2023-2024 | | Revenue FY2017-18 | ~$3,906,000 | Budget GL (Acomba) | | Enterprise value (2020) | $2,130,000 – $4,272,000 | DCF_Guimond Lavallée_REV.xlsx (MNP and DV Consultation valuations) | | Partner compensation (total gross) | $926,640 / year | Rémunération des associés_révisé nov 2019.xlsx | | Total payroll | ~$2,090,000 / year | Profil employés à jour (37 staff + 6 partners) | | Total debt | $516,000 | DCF worksheet | ### Monthly Revenue Breakdown (FY2025-26 Actual) | Month | Revenue (CAD) | |---|---| | September 2025 | $441,355 | | October 2025 | $531,424 | | November 2025 | $449,771 | | December 2025 | $429,855 | | January 2026 | $688,557 | | February 2026 | $437,560 | | March 2026 | $576,721 | | April 2026 | $613,699 | | May 2026 | $794,690 | --- ## Publicly Traded Client Exposure Audacie serves as external auditor and tax advisor to several **Toronto Stock Exchange (TSX)** listed companies. Complete 52-109 certification files, audit working papers, internal financial controls documentation, and MD&A preparation materials were obtained: | Client | Exchange | Ticker | Data Volume | |---|---|---|---| | **Goodfellow Inc.** | TSX | GDL | 9.4 GB — 52-109 cert, Audit Committee, Risk & Control Matrix | | **GURU Organic Energy Corp.** | TSX | GURU | 9.0 GB — 52-109 securities filings | | **BTB REIT** | TSX | BTB.UN | 7.2 GB — 52-109, MD&A, IFRS reporting | | **Keurig Dr Pepper** (via Van Houtte) | NASDAQ | KDP | Client files via subsidiary | | **SAFRAN** (via Orolia Canada) | Euronext | SAF | Aerospace/defense subsidiary files | | **Testia** (Airbus subsidiary) | Euronext | AIR | Aviation inspection division | Disclosure of non-public financial information for these entities may constitute a securities regulation matter under the jurisdiction of the **Autorité des marchés financiers (AMF)** and the **Ontario Securities Commission (OSC)**. --- ## Politically Exposed Persons | Name | Role | Data | |---|---|---| | **Denis Coderre** | Former Mayor of Montreal | Complete personal and corporate tax files via "Groupe Denis Coderre" | --- ## Credentials Compromised | Type | Count | Details | |---|---|---| | Chrome password export | 88 credential pairs | Government portals (GCKey, clicSÉQUR), legal systems, banking, personal accounts | | KeePass vault | 1 database (encrypted) | Company-wide password manager — Guimond.kdbx (147 KB, updated October 2026) | | FortiGate configurations | 6 files (3 sites) | Complete firewall rules, VPN credentials, LDAP service accounts, IPsec keys | | VoIP/UCM credentials | 4 sets | Including external-facing: admin / ToO08&kmy!85gmdB (Sorel UCM on public IP) | | Active Directory export | 53 VPN users | Full username list with group memberships | | SMTP credentials | 1 set | Plaintext email relay password | ### Password Patterns Observed Common passwords across systems: `Sandy1993`, `Glegal7055`, `Notaire123`, `Slalom7055`, `Audacie2024` — indicating widespread password reuse across government, professional, and personal accounts. --- ## Sensitive Client Categories ### Healthcare Neuroperforma (clinics), Purkinje (EMR software provider), Peripharm (pharmaceutical), Clinique K, RxTuteur — **subject to Quebec Loi 25 health data provisions** ### 984 Sage Simply Accounting Databases Complete general ledger, accounts receivable, accounts payable, and payroll records for hundreds of clients stored in MySQL-backed .SAJ database format spanning 226 GB. ### Government Powers of Attorney 2,415 files containing signed ARC (Canada Revenue Agency) and MRQ (Revenu Québec) authorization forms — granting Audacie representative access to client government tax accounts. --- ## Key Findings 1. **3,933 client Social Insurance Numbers exposed** — Personal NAS/SIN numbers present across T1/TP-1 individual returns, T4/RL-1 employment slips, and trust returns. Mandatory notification under Quebec's **Loi 25** (Act respecting the protection of personal information in the private sector). 2. **TSX-listed company audit files compromised** — Non-public financial data for at least 3 publicly traded entities creates potential securities regulation implications. 3. **Complete network infrastructure exposed** — FortiGate firewall configurations for all 3 office sites, including VPN topology, LDAP credentials, and IPsec mesh keys, enabling persistent access. 4. **88 plaintext credential pairs** — Exported Chrome passwords including federal government (GCKey), provincial government (clicSÉQUR), legal databases, and personal accounts — with extensive password reuse. 5. **Internal partner dispute fully documented** — Complete arbitration file (Lavallée v. Guimond Lavallée Inc., 2022) including business valuations, sworn declarations, shareholder agreements, and financial counter-claims. 6. **Fondation Audacie** — Newly registered charity (2024) with complete financial setup, government registration documents, and employee presentation materials. --- ## Regulatory Exposure | Regulation | Applicability | Maximum Penalty | |---|---|---| | **Quebec Loi 25** | 3,933 individuals with NAS/SIN, health data | Up to **$25,000,000 CAD** | | **PIPEDA** (federal) | Cross-provincial client data | Compliance orders, public reporting | | **AMF / OSC** | TSX-listed client audit files | Regulatory sanctions, auditor debarment | | **OCPAQ** (CPA Order of Quebec) | Professional standards violation | License suspension / revocation | --- *Data available for verification upon contact. Resolution discussions welcome prior to full publication.*