Crime Stoppers makes one promise to the people who call it: nobody will know who you are. A CBC investigation published October 21 suggests that promise did not hold for a very large number of Canadians. CBC reported that more than 1.5 million tips sent to Canadian Crime Stoppers programs over 25 years were in data stolen last March from P3 Global Intel, the tip-management platform owned by the US company Navigate360. CBC said at least half of those tips contained personal information.

Within a day, Toronto Crime Stoppers froze its operations. Police services across Ontario then began suspending their partnerships or removing references to the program. The story also shows how a breach at one software vendor can travel across a border and undo, in one go, a guarantee that local organizations had made separately to the public for decades.

What CBC Found

CBC reported that the data was stolen in March by a hacktivist collective called Internet Yiff Machine. A copy was made available to journalists by DDoSecrets, a group that archives leaked material. CBC searched the cache, found Canadian tips going back a quarter century, and reached more than a dozen of the tipsters named in it.

The attribution to Internet Yiff Machine comes from CBC's reporting, and The Record reported that the group took responsibility itself. This article does not attribute the attack to anyone beyond what those outlets state.

The platform at the centre of the story is P3, which Navigate360's P3 Global Intel unit runs. Crime Stoppers chapters use it to take anonymous tips online and to manage them. Anonymous tip lines like this rest on one design idea: the organization receiving the tip should never learn, or keep, the tipster's identity. A tip that includes a name, phone number, email address or other personal details stops being anonymous once it sits in a database someone can steal.

Toronto's Numbers

According to The Record, Navigate360 told Toronto Crime Stoppers that the stolen data held 176,859 Toronto tips submitted between January 2022 and November 2025. Navigate360 said 14,973 names were found in those records. The company could not say whether the names belonged to tipsters or to the suspects they were reporting.

That uncertainty matters. A suspect's name in a tip is expected; that is the point of the report. A tipster's name is the thing the system exists to protect. Either way, the exposure is serious. A leaked tip can tell a suspect who may have reported them, and it can tell anyone reading the dump who was accused of what, whether or not the accusation was ever confirmed.

Toronto Crime Stoppers chair Sean Sportun said in a statement, reported by The Record, that for some tipsters the promise of anonymity had been broken. The chapter said it directed Navigate360 to stop taking tips on its behalf.

Ontario Police Pull Back

CBC's follow-up, updated October 23, reported that at least eight Ontario police units had paused their use of Crime Stoppers. CBC named Toronto, York Region, Halton, Windsor, Kingston, Cornwall and Hamilton, and said Durham had removed references to the program. On the Crime Stoppers side, CBC reported that Toronto, Guelph Wellington, Peel and Waterloo Regional Crime Stoppers had stopped accepting anonymous tips.

York Regional Police said in a statement that it was suspending its partnership with Crime Stoppers effective immediately and was reviewing the data included in the breach. It told people with information to contact police directly, and said plainly that although it will work to keep a tipster's identity private, anonymity cannot be guaranteed.

The Waterloo Regional Police Service gave a timeline that runs well ahead of the October reporting on the Canadian figures. In an October 22 statement, WRPS said it learned in late June 2026 of a cybersecurity incident at Navigate360. It said it later received confirmation that Waterloo Regional Crime Stoppers had been impacted, and that WRPS suspended promotion of Crime Stoppers as a reporting option in early July. WRPS also said the Navigate360 platform is not integrated or connected to its own information technology systems. That is useful to know: the platform sat with the vendor, outside police networks.

The gap between late June and late October matters too. At least one police service knew about the incident and acted on it months before CBC's October reporting showed the scale of the Canadian exposure, including to tipsters whose details may be in the data.

The US Side of the Same Breach

Navigate360 is a US company, and the P3 breach drew attention in Washington long before the Canadian figures came out. In an April 24, 2026 letter, US Senators Maggie Hassan and Jim Banks wrote to Navigate360 CEO JP Guilbault and to the co-CEOs of its owner, The Riverside Company. They expressed "significant concern" about the cyberattack on the P3 Global Intel anonymous tip-line platform.

The letter says attackers breached the platform in March 2026, stole significant amounts of data and released it online. It cites earlier coverage by Reuters and Education Week. It says more than 35,000 schools and 5,000 public safety agencies use Navigate360's products. The senators wrote that the personally identifiable information released by the hackers suggests the platform is not anonymous, as the company markets it. They asked the company to explain what was stolen, how it is responding and what safeguards it will put in place. The letter also says Navigate360 hired an independent third party to investigate.

The senators' letter covers the US side of the breach. It does not mention the Canadian tips or the Ontario police response. CBC, for its part, reports that the Canadian tips came from the same P3 Global Intel data leaked in March 2026.

What It Means for Defenders

Who is affected. The people directly at risk are those who submitted tips to Canadian Crime Stoppers programs through the P3 platform, and those named in tips. The Toronto data alone covers nearly 177,000 tips from January 2022 to November 2025, according to Navigate360. Organizations affected include Crime Stoppers chapters and the police services that partner with them. Going by the senators' letter, schools and public safety agencies in the US that use Navigate360's products may also be affected.

What the sources say organizations are doing. The steps reported so far are mostly containment steps. Some chapters have stopped accepting tips through the vendor. Police services have suspended partnerships, removed references to the program and stopped promoting it. They are reviewing the breach data and sending people to contact police directly. Crime Stoppers in New Brunswick told CBC it reset passwords, mandated two-factor authentication and will train tip operators, and it continues to accept anonymous tips. None of the sources describes an independently verified fix to the platform, and none says when the paused programs will resume.

If your organization runs or buys a tip line. This breach is mainly about how long data is kept and how much of it is collected. Some points to review, which are our analysis rather than claims from the sources:

  • Ask your vendor what it actually stores. An "anonymous" product that keeps contact details, free-text tips and long histories becomes a target as that data piles up. Get the vendor to say in writing what fields it keeps, for how long, and who can reach them.
  • Set and enforce retention limits. CBC reports tips going back 25 years. Old tips that were closed long ago carry risk and little value. Delete what you no longer need, and check that the vendor deletes it too.
  • Contract for breach notification. WRPS learned of the incident in late June, while the scale of Canadian exposure became public in October. Your agreement should say how fast the vendor must tell you, and what it must tell you, so you can make your own decisions about notifying people.
  • Keep the vendor separate from your network. WRPS was able to say the platform was not integrated with its systems. You should be able to answer that question about every third-party platform you use, before an incident happens.
  • Plan how to talk to the people affected. When anonymity fails, people may face retaliation and not just fraud. Have a way to warn tipsters, and have a channel to send new reporters to while the main system is down, as York Regional Police did.

For federal contractors and CMMC shops. The pattern looks familiar. Sensitive data you collected ends up exposed through a SaaS provider you chose. That is why supply-chain and third-party risk sections exist in security frameworks. Treat any vendor that holds data you have promised to protect as part of your attack surface.

For individuals. If you submitted a tip to an Ontario Crime Stoppers program, police services are telling people to contact them directly for now. York Regional Police warns that anonymity cannot be guaranteed if you do. Weigh that before sharing anything sensitive.

Sources