Overview
The Toronto chapter of Crime Stoppers broke ranks with the national association late on Wednesday, publishing a timeline of what it knew and when, and announcing it is pausing operations. The decision follows reporting by CBC on a leak of anonymous tip data held by vendor Navigate360 and its subsidiary P3 Global Intel.
Timeline
| When | Event |
|---|---|
| March 2026 | Hacked data is made available to DDoSecrets. The hacktivist collective Internet Yiff Machine claims responsibility, saying it wanted to show Navigate360 and P3 Global Intel misrepresented their capabilities. |
| Days later | The Canadian Crime Stoppers Association and its chapters confirm a breach but give no detail on what was exposed. |
| April | Navigate360 tells Toronto its data was not taken. |
| June | Navigate360 says Toronto's data was affected, without specifying what. |
| Around October 21 | After CBC's reporting, Toronto Crime Stoppers publishes its timeline and pauses operations. |
Data Exposed
- CBC found more than 1.5 million tips from Crime Stoppers chapters across Canada were exposed, some going back 25 years.
- About half of the tips CBC reviewed contained personal information.
- For Toronto, Navigate360 reported 176,859 tips from January 2022 to November 2025, including 14,973 names. It could not say whether the names belonged to tipsters, suspects, or both.
Response
Toronto Crime Stoppers directed Navigate360 to stop accepting tips and processing new information, and told Canada's National Anonymous Call Centre to stop handling Toronto-bound tips. It asked the public not to submit tips by phone, online or through the app until a safer method exists, and says it is seeking a way to accept tips truly anonymously.
The chapter says it has repeatedly asked, through its lawyers, for the text of the stolen tips, and Navigate360 has not responded. The national association blamed the vendor for the lack of information. Toronto's statement included an apology: "We are deeply sorry."
Lessons
- Anonymity is a security property. A service promising anonymity must be able to prove what it stores and for how long; retaining names and free-text tips for years raised the cost of this breach.
- Vendor incident reporting needs contractual teeth. Months passed between the breach and clear answers about exposed data. Require breach notification timelines and data-scope disclosure in third-party contracts.
- Minimize retained data at vendors handling sensitive submissions.