When the tip line leaks: Lessons from the Crime Stoppers breach

Crime Stoppers has run on one promise for decades: you can tell us what you know, and no one will ever know it was you.

On October 21, a CBC News investigation showed how badly that promise has been broken. More than 1.5 million tips submitted to Canadian Crime Stoppers programs over the last 25 years were exposed in a breach, and more than 850,000 of them contained personally identifiable information about tipsters, the people they named, and even Crime Stoppers staff and police.

The details were specific enough for CBC to reach more than a dozen tipsters directly. One of them, a Manitoba man who reported illegal cigarette sales in 2025, now worries his home address and phone number could be used for retaliation. Another gave a tip about the murder of a loved one; police have since charged someone in that case.

The Canadian tips are one slice of a larger theft. In March 2026, a hacktivist group calling itself Internet Yiff Machine took more than 8.3 million records from P3 Global Intel, the Navigate360 owned platform that Crime Stoppers hired to manage its tips. The group’s stated goal was to disprove P3’s claim that the platform was anonymous and secure, and a copy was later shared with journalists and researchers by the nonprofit Distributed Denial of Secrets.

Over six months later, the Canadian Crime Stoppers Association (CCSA) and the chapters it represents (68 are registered as nonprofits in Canada, according to Canada Revenue Agency data cited by CBC) had still said little beyond confirming the hack, and were waiting on a detailed report from the vendor.

I have seen a lot of breach disclosures. This one sits in a different category, and it is worth being precise about why.

Why this breach is different

Most breaches expose data that supports a business. This one exposed the business itself.

A tip line has one product, and that product is anonymity. Once a tipster’s identity is attached to a tip in a stolen dataset, the service has failed at the only thing it exists to do.

Prof. Ali Dehghantanha, Canada Research Chair in Cybersecurity and Threat Intelligence at the University of Guelph, reviewed limited samples of the data for CBC. His verdict was that the anonymity promise has “failed categorically.”

The harm is also unusually hard to undo. A leaked card number gets cancelled. A leaked password gets rotated. There is no reset for a record saying a person reported their neighbour for dealing firearms. That fact is now permanent, and the people most motivated to act on it are exactly the people the tips were about.

The content makes it worse.

CBC found tips about murders, terrorism, missing persons and organized crime groups including the Hells Angels and the Red Scorpions. A third of all tips concerned drugs. Nearly 49,000 tips were linked to cases cleared by an arrest or charge, and nearly 1,000 tipsters were approved for cash rewards, with hundreds of banking records attached.

A database that can link a tip that led to an arrest with the bank details used to pay its reward is about as dangerous as data gets.

Then there is the time horizon. CBC’s analysis covers about 25 years of Canadian submissions, and the wider dataset reportedly reaches back to 198.. Someone who called in a tip in 2003 had no reason to think about it in 2026.

Their risk was created by a retention decision they never saw, made by a tip program and a vendor most of them have never heard of.

Where the controls failed

The intrusion method has not been made public, and I won’t speculate about it. What matters more is what the attacker found once inside.

The reporting points to five failures, and none of them depend on how the attacker got in.

1. Sensitive fields were readable. Distributed Denial of Secrets, which distributed the data, said that although P3 described the platform as encrypted, the data was allegedly retrieved in plaintext. The copy CBC analyzed held street addresses, phone numbers, personal emails, licence plates and banking details in readable form. Whatever encryption P3 used, it did not keep that data from being read.
2. The organization knew, and the data stayed exposed. Hundreds of tips carried staff notes flagging that a tipster had “self-identified” or been “exposed.” The identifying details were still there, unredacted. Detection without remediation is just documentation.
3. Nobody could tell whose data was whose. The CCSA told CBC that the information available to it does not distinguish people who submitted tips from people identified in them.Whether that reflects how the data was structured or how little the vendor has shared, it is now complicating notification.
4. Nothing expired. Twenty five years of Canadian tips were still online. Ben Coon, chief intelligence officer at Unit 221B, put it simply to CBC: a closed tip does not need to stay online. A record deleted after a case closes cannot be stolen later.
5. One vendor, dozens of programs. P3 is a shared, hosted platform. Each Crime Stoppers chapter inherited the security posture of a supplier it did not operate. The person claiming to speak for the hackers told CBC in September that P3’s security was “terrible” and that the platform remains vulnerable.

The common thread is that protection stopped at the perimeter.

Firewalls, network segmentation and disk encryption are all necessary. None of them protect the data itself once an attacker, or a misused admin account, is talking to the system the way the application does.

At that point the data is only as safe as its own form, and here its form was readable text.

What it means for the public

Four groups carry the risk, and none of them chose it.

• Tipsters. The immediate concern is retaliation. A tip about bikers, cartels or a family member breaching a court order names someone with both a motive and a means to respond. CBC found more than 4,300 tips where the tipster gave a full name (under one per cent of entries, and CBC could not verify every name), and hundreds of thousands more containing addresses or phone numbers that could identify someone in the tip.
• The people named in tips. A tip is an allegation, not a finding, and CBC notes the allegations were not necessarily investigated or proven. Those people now have unproven accusations, sometimes next to their home address, in a dataset that has been in a dataset that one of the people claiming responsibility says they briefly tried to sell.
• Anyone in the data, as a fraud target. Dehghantanha pointed out that a caller who can reference the tip you gave earns your trust immediately. Coon listed financial fraud, extortion and money laundering as realistic uses. The dataset is a ready made social engineering script.
• Everyone who might call next. This is the slow damage. Anonymous reporting works only if people believe it is anonymous. If a witness hesitates because of this story, a case goes unsolved, and no breach notification will ever capture that cost.

That last point is why I think this breach deserves more attention than its record count suggests. It is an attack on a piece of public safety infrastructure that depends entirely on trust.

What it means for the organizations

For Navigate360, the exposure is legal and commercial. The company did not respond to CBC’s questions about what security changes it has made since the hack, whether it has shared findings with Crime Stoppers, or whether it is still collecting tips.

Silence is a hard position to hold once journalists have contacted the people in your data.

For the CCSA and its chapters, the problem is harder. More than six months after the theft, they were still waiting on the vendor for a detailed report. The RCMP told CBC it was first advised that no Canadian data was affected, then told in May that Canadian data was involved but contained no tipster PII.

CBC’s findings contradict both. And because the CCSA says it cannot distinguish tipsters from the people they named, it says it has concerns about notifying anyone without putting tipsters at further risk.

Outsourcing the platform did not outsource the obligation. As Dehghantanha told CBC, “you cannot outsource the accountability.” Which privacy statute governs a nonprofit tip program depends on the province and the activity, and some of it may fall outside any statute. Where one applies, an organization that hands personal information to a processor stays accountable for it, and the public holds it accountable either way..

Police services operate separately from Crime Stoppers, but the reputational hit lands on them anyway. To the public, a Crime Stoppers tip is a police tip. The RCMP has now said the breach could jeopardize the safety of tipsters, the people named in tips and police officers.

Toronto Police, whose local chapter had the most tips in the leak, says it was notified in March. Police in Hamilton and Waterloo Region confirmed in June and July that their local programs’ data was involved, and Waterloo stressed that the platform was separate from its own systems.

Protect the data, not just the system around it

This is the problem we work on at DataStealth, so I will be direct about both what our approach changes and what it does not.

The core idea is simple: a sensitive value should not exist in readable form anywhere it does not need to.

In practice, that means replacing fields like a tipster’s name, phone number or address with tokens at the point the data enters the environment, before it is written to the application database. A vaulted token has no mathematical relationship to the original value, so stealing the database yields placeholders, not people.

The real values sit in a separate vault, and only the users and applications your policy allows can reveal them, with every reveal logged.

Applied to a tip platform, that model changes the outcome in specific ways:

• A stolen database stops being a list of identities. The allegation text may still leak, but the fields that link it to a person do not.
• You know what you hold. Discovery and classification at the field level tells you which records contain names, phone numbers and addresses, and where. Combined with how the data was collected, such as a tipster’s contact field versus the tip narrative, it lets you start answering the question the CCSA says it cannot.
• Identity and content are separated by design. An attacker, or an insider, has to compromise a second system with its own controls to put them back together.
• Every reveal leaves a record. If someone tries to de-anonymize a tipster, it shows up in the audit trail rather than going unnoticed.
• It does not require rebuilding the application. Because we protect data in the network path, without agents or code changes, the operator of an existing platform can put field-level protection in front of it. For anyone buying a hosted platform, that makes it a reasonable thing to require of the vendor.

What it does not do is stop an intrusion, or decide how long you keep data. Those remain your access controls and your retention policy. Tokenization limits what an attacker gets when the other controls fail (the difference between breach prevention and breach resilience), and in this case they did.

Five questions to ask this week

You do not need to run a tip line for this to apply. Whistleblower hotlines, HR complaint systems, patient portals and fraud reporting forms all hold the same kind of data: information that is dangerous precisely because of who said it.

If your organization collects anything like that, start here.

1. If someone copied our database tonight, what could they read? Answer for the database, the backups and the logs, not just the application screen. Our data risk assessment tool walks through the same question.
2. Can we tell whose personal information is whose? If you cannot separate a reporter from the person reported on, you cannot protect or notify either of them.
3. When our staff flag exposed data, does anything actually change? A note that says “self-identified” is not a control.
4. How long do we keep it, and who decided? Every year of retention is a year of liability. Records tied to closed matters should have an end date.
5. Could we scope a breach without waiting on the vendor? If you cannot see what was exposed, you are depending on the party that just failed to tell you.

The Crime Stoppers breach will be studied for a long time. The lesson I hope sticks is that anonymity is a property of the data, not a promise on a website.

It has to be built into how the data is stored, or it is not really there.