Crime Stoppers

Summary

A hacking group compromised the tip-management platform used by Crime Stoppers, exposing more than 1.5 million tips submitted to Canadian chapters over a quarter-century along with tens of thousands of unredacted personal details. The breach, attributed to Internet Yiff Machine, targeted Navigate360 and its P3 system, which was marketed as anonymous and secure. Inconsistent statements from the Toronto and Guelph Wellington chapters initially downplayed the scope before acknowledging that years of local data had been stolen. Police services across Ontario and other parts of Canada subsequently suspended their use of the tip line. Privacy experts said affected tipsters may have limited legal options for compensation under current privacy law, potentially leaving class action lawsuits as an alternative.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A data breach affecting Crime Stoppers across Canada was revealed by a prominent Toronto news portal two days before broader expert commentary emerged in October 2026. The breach centered on Navigate360 and its tip-management platform, P3, which all Crime Stoppers chapters in Canada and the United States had relied on to maintain anonymity for submitted tips. The information was stolen by a hacking group known as Internet Yiff Machine in March 2025. After the hack was uncovered, the group claimed it wanted to disprove Navigate360's assertions that its platform was anonymous and secure. Investigators who examined a copy of the hacked data found that over 1.5 million tips submitted to Canadian Crime Stoppers programs over the previous 25 years were exposed. The exposed material also included tens of thousands of unredacted personal details. Michael Geist, a law professor at the University of Ottawa and the Canada Research Chair in Internet and E-commerce Law, described the incident as potentially one of the most harmful data breaches ever seen in Canada. He stated that under Canadian law both Crime Stoppers, as the organization that collected the data, and Navigate360, as the company hired to manage the data, could be held accountable.

The response from individual chapters was inconsistent. The Toronto chapter initially said Navigate360 told them no Canadian data had been taken, then claimed Toronto was not impacted, before finally revealing that years of Toronto data had been compromised. The Guelph Wellington chapter issued a similar statement the following day. These conflicting accounts added to the controversy surrounding the breach. As a result of the exposure, police services across Ontario and other parts of Canada suspended their use of Crime Stoppers. The suspension affected the intake channel that law enforcement had previously relied on for anonymous tips.

Privacy experts cautioned that tipsters whose information was leaked may have limited options for justice. They noted that current privacy law does not really address actual compensation for affected individuals. Individuals seeking compensation may need to consider other avenues, such as class action lawsuits. The long-term implications of the breach remained under consideration by experts as one of the country's most severe privacy failures.

Sources

Sources available to members: 1 source.