Crime Stoppers

Summary

A hacktivist collective breached the tip management platform used by Crime Stoppers, exposing more than 1.5 million tips submitted over a quarter century along with unredacted personal details such as names and addresses. The U.S.-based vendor confirmed the intrusion months after it occurred and acknowledged that records including social security numbers may have been accessed, though it said it had no evidence of fraud or identity theft. Police services across Ontario suspended use of the anonymous tip program, and the organization’s national association advised chapters not to contact regional privacy commissioners, citing a lack of jurisdiction. Experts described the incident as potentially one of the most harmful privacy failures in the country and criticized the vendor’s shifting accounts and rapid return to operation without a full investigation.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The breach centered on Navigate360 and its P3 tip management platform, which Crime Stoppers chapters in Canada and the United States used to keep tipster data anonymous. Hacktivist collective Internet Yiff Machine stole the information in March 2026, stating that they wanted to disprove the company's claims that the platform was anonymous and secure. CBC News analyzed a copy of the hacked data and found that more than 1.5 million tips submitted to Canadian Crime Stoppers programs over the previous 25 years were exposed, along with tens of thousands of unredacted personal details. Navigate360 confirmed in a Friday press release that its database had been breached between November 2025 and March 2026, acknowledging the incident publicly seven months after the hack. The company stated that potentially impacted information included records such as names, addresses and social security numbers, but said it had no evidence the data was used for fraud or identity theft. Toronto Crime Stoppers was told about the leak on March 18, and on March 25 Navigate360 informed the organization that the system was safe and fully operational. Police services across Ontario and elsewhere in Canada suspended their use of Crime Stoppers after CBC's investigation was published. Toronto, Halton and Guelph were among the Ontario cities temporarily pausing Crime Stoppers tip programs, and Winnipeg police also suspended use of the program. The Toronto branch of Crime Stoppers asked the public not to submit tips until the issue was resolved.

The breach compromised the identities of thousands of Canadian tipsters by exposing 25 years of unredacted personal information. Toronto and Guelph Wellington Crime Stoppers chapters reported that Navigate360 changed its narrative multiple times about how much data had been stolen and what was affected, with Toronto reportedly receiving six different accounts in seven months from the vendor. Cybersecurity expert Ali Dehghantanha, who reviewed samples of the compromised data, said the shifting accounts raised red flags about the company's ability to investigate the hack and fix vulnerabilities, and expressed surprise at how quickly Navigate360 returned its system to an operational state. Navigate360 did not respond to CBC's multiple requests for comment over the past week. In a public statement, CCSA president David Forster said Navigate360 advised that third-party cybersecurity experts investigated the breach, identified vulnerabilities and completed remediation, adding that these measures strengthen protections for current and future tips. Forster also noted that the measures cannot undo the exposure of information already taken, which remains a serious concern. An internal CCSA memo dated June 18 instructed chapters that they were not required, nor should they contact the regional privacy commissioner at that time, based on a prior assessment that the commissioner does not have jurisdiction over Crime Stoppers. CBC contacted the Canada and Ontario privacy commissioners to ask whether they were investigating the breach, whether they had received citizen complaints, and whether they had jurisdiction over Crime Stoppers. Legal observers noted that current privacy law does not focus on compensation for affected individuals, though class actions and privacy commissioner investigations remain possible avenues, with the commissioner able to issue only non-binding findings.

Sources

Sources available to members: 1 source.