Crime Stoppers data breach exposes 1.5 million Canadian tips via P3 Global Intel
In short
A March 2026 hack of P3 Global Intel exposed over 1.5 million Canadian Crime Stoppers tips spanning decades, with roughly half containing PII.
The Crime Stoppers data breach through P3 Global Intel compromised more than 1.5 million Canadian tips reported between February 1987 and November 2025. The incident, first reported in March 2026, involved the theft of 93 GB of data containing 8.3 million records overall from the cloud platform owned by Navigate360. Analysis published by CBC on October 21, 2026, confirmed the Canadian portion and highlighted risks to tipster anonymity.
P3 Global Intel served as an anonymous reporting system for Crime Stoppers chapters, schools, law enforcement agencies, and other organizations. The platform marketed secure tip submission, yet the breach revealed multiple weaknesses that allowed unauthorized access.
Access method and platform vulnerabilities
The hacker group Internet Yiff Machine gained initial entry through social engineering of a customer account. Once inside, they exploited several design flaws: absent rate limiting, insecure direct object references, plaintext storage of sensitive fields, and cookies without the HttpOnly flag. The system also permitted internal requests for tipster IP addresses, undermining the anonymity guarantee.
Data included names, addresses, phone numbers, emails, license plates, and banking details for reward payments. Over 4,300 tips contained full names provided by tipsters themselves despite platform instructions to remain anonymous. Roughly 850,000 Canadian records held personally identifiable information on tipsters, named individuals, staff, or officers. The hacker attempted to sell the data for about 10,000 USD in cryptocurrency before withdrawing the offer.
Experts noted that long-term retention of unredacted records and the absence of basic access controls amplified the exposure. No public data dump has been confirmed as of October 21, 2026, though the initial theft placed the information at risk of further distribution.
Responses from Canadian authorities and Navigate360
The Canadian Crime Stoppers Association stated it became aware of the security incident and awaited a detailed report from Navigate360. President David J. Forster emphasized that protecting safety and anonymity remained the top priority while communicating with the provider about affected records and future security measures. The association expressed caution about notifying individuals, noting that the dataset does not always clearly separate tipsters from named parties.
The RCMP initially assessed that Canadian data was unaffected but later confirmed in May 2026 that Canadian records were included. Subsequent statements acknowledged potential risks to tipsters, named individuals, and officers. Navigate360 reported engaging third-party forensics and the FBI; early statements indicated that sensitive information misuse had not been confirmed at the time.
Some U.S. agencies temporarily advised against using the platform. Class-action investigations have been initiated in the United States against Navigate360. Canadian chapters continue to operate the system while remediation details remain pending.
Practical implications for users and organizations
Tipsters who relied on Crime Stoppers anonymity now face uncertainty about possible retaliation. Organizations that adopted P3 Global Intel should review their data-handling practices, including retention periods and encryption standards. Individuals concerned about prior submissions can monitor official statements from the Canadian Crime Stoppers Association for verified updates.
Key vulnerabilities identified in the breach:
- Social engineering of customer credentials
- Missing rate limiting on API endpoints
- Insecure direct object references allowing record enumeration
- Plaintext storage of PII and reward banking details
- Absence of HttpOnly flags on session cookies
Platform operators in similar sectors can compare these controls against their own configurations. The breach underscores the need for regular penetration testing and strict separation between internal administrative functions and tip data.
Frequently asked questions
What data was taken in the Crime Stoppers data breach?
The breach included 93 GB of records with names, addresses, phone numbers, emails, license plates, and banking details linked to tips submitted between 1987 and 2025. More than 1.5 million Canadian tips were identified in the dataset.
How did the hacker access P3 Global Intel?
Initial access occurred through social engineering of a customer account. The attacker then exploited missing rate limiting, insecure direct object references, and plaintext storage of sensitive information.
Has the Canadian Crime Stoppers Association notified affected individuals?
The association has not issued individual notifications due to difficulty distinguishing tipsters from named parties in the dataset. It continues to communicate with Navigate360 and will share verified information when available.
Is the P3 Global Intel platform still in use by Canadian chapters?
Some Canadian Crime Stoppers chapters continue to use the platform as of October 2026 while forensic investigations and security remediation proceed.
TrustScope
Comments 4