An exclusive CBC News investigation published October 21, 2026 found that more than 1.5 million tips sent to Canadian Crime Stoppers chapters were captured in a hack announced in March 2026. CBC's analysis found that at least half of those tips included personal information. The tips go back about 25 years. Some contained enough detail for CBC journalists to identify and contact more than a dozen tipsters, who said they were shocked and feared for their safety. CBC attributes the theft to the hacktivist collective Internet Yiff Machine. Secondary reporting places the Canadian records inside a much larger breach of P3 Global Intel, the tip-management platform used by Crime Stoppers programs across North America. The anonymity promise that public crime reporting depends on has been broken at scale, and the leaked data shows it.
What Happened
According to CBC, Internet Yiff Machine stole the data in March 2026 and released it with a manifesto. Streamline Feed, which summarizes the CBC findings, says the group's stated goal was to disprove marketing claims that the platform was fully secure and anonymous.
Two secondary sources identify the breached system as P3 Global Intel, a cloud-based tip-management platform owned by Navigate360. Streamline Feed and Rose City Beat both describe it that way, and Rose City Beat calls P3 Texas-based. The platform serves Crime Stoppers chapters, law enforcement agencies and schools. The CBC excerpt available for this brief does not name the vendor, so we treat the P3 attribution as well reported but not confirmed by a primary source.
Accounts of the overall size of the breach are consistent between the secondary sources:
- Canadian tips: more than 1.5 million, from CBC's own analysis of the leaked data.
- Global total: more than 8.3 million crime tips (Streamline Feed). Rose City Beat says the hacker group "claimed" more than 8.3 million records. This is an attacker-claimed figure, and no vendor or regulator has confirmed it in our sources.
- Volume: about 93 GB, reported only by Streamline Feed.
- Time span: Streamline Feed says the global dataset reaches back to February 1987. CBC puts the Canadian tips at roughly the last 25 years.
The effects have reached outside Canada. Portland Police Bureau issued a public statement on March 19 about the breach. Crime Stoppers of Oregon dissolved on September 30, 2026, after 43 years. Its chairman blamed falling tip numbers, a shrinking reward program and an aging board, but Rose City Beat reports that the P3 breach "added urgency." We found no primary statement from Navigate360/P3 Global Intel or from Canadian Crime Stoppers among the sources for this brief.
What Was Taken
Sources broadly agree on the sensitivity of the data but describe its contents differently:
- CBC (outlet): At least half of the 1.5 million+ Canadian tips contained personal information. In the tipster cases CBC confirmed, this included full names, and one tipster fears his home address and phone number could be used against him. One Manitoba tipster, Andrew Rivard, had reported illegal cigarette sales after seeing a $2,000 reward offer, and his tip appeared in the leak under his full name.
- Streamline Feed (other): Describes half the tips as containing "unredacted" personal data, including names, addresses and banking information linked to cash reward payouts.
- Rose City Beat, citing Malwarebytes (other): Describes the wider P3 dataset as including names, addresses, phone numbers, dates of birth, licence plates and Social Security numbers of people named in tips.
The data harms two groups. Tipsters risk retaliation from the people they reported. People named in tips, many of them never charged or convicted, have unverified allegations tied to their identifiers in a public leak. CBC confirms the first group is exposed. The Social Security number and banking details come only from OTHER-tier sources, so treat them as reported, not confirmed, for the Canadian subset.
Why It Matters
- The trust model has failed. Anonymous tip lines only work if informants believe they are anonymous. The vendor, not the chapters, held 25+ years of tips in one cloud store. That turned a promise of anonymity into one target that could be breached once. Oregon's shutdown shows the damage reaches the programs themselves.
- Retaliation is a physical safety risk. Most breaches create fraud risk. This one gives criminals a lookup table of who reported them, with home addresses.
- Concentration risk in public-safety SaaS. One vendor compromise exposed tips across many independent nonprofits, police agencies and schools in several countries.
- Hacktivist motive. The attackers did not demand a ransom. They wanted to embarrass the vendor and expose its security claims, so they had every reason to publish the data widely rather than sell it quietly.
- Regulatory exposure. Under PIPEDA, a breach that creates a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and to affected individuals "as soon as feasible," and records of every breach must be kept for two years (Promatics, summarizing OPC guidance). Exposing tipster identities is very likely to meet that bar. Whether PIPEDA, provincial law or both applies to each chapter and to the vendor depends on jurisdiction and commercial activity. Our sources do not say whether any notifications have been filed.
- Part of a wider pattern of justice-sector breaches in 2026: The same year, Thomson Reuters disclosed that its C-Track court case-management cloud, used by three Ontario courts, was breached starting in March and only detected June 30 (CBC). ShinyHunters separately breached FBIjobs.gov, and a Canadian was arrested in connection (Globe and Mail). Nothing in the sources links these incidents to Internet Yiff Machine or to the Crime Stoppers breach. Together they show that third-party platforms holding justice-system data are being targeted repeatedly.
The Attack Technique
How Internet Yiff Machine got into P3 Global Intel has not been disclosed in any of the sources we reviewed. None describe an initial access vector, a CVE, compromised credentials or a dwell time. Streamline Feed says FortiGuard Labs analysts noted the group has previously targeted justice systems, but its excerpt is truncated and we could not verify the claim further.
Readers should not mix this incident up with the ShinyHunters campaign reported in the same period. That campaign exploited the Oracle PeopleSoft flaw CVE-2026-35273, an unauthenticated RCE patched June 11, 2026, against about 100 organizations (Canadian Cyber Watch, citing BleepingComputer). According to Mandiant/GTIG, it later used a URL-encoding trick (/%50SEMHUB/ instead of /PSEMHUB/) to get past WAF rules on unpatched servers. Rescana reports ShinyHunters claimed a separate, undisclosed pre-auth PeopleSoft zero-day in the FBI breach. These are useful lessons for defenders of any SaaS platform, but there is no evidence linking that technique to the P3 Global Intel compromise.
What Organizations Should Do
- Notify and protect exposed tipsters now. Crime Stoppers chapters and police agencies should go through the leaked tips for identifiable reporters, start with cases involving violent or organized crime, and contact those tipsters about safety planning. Don't wait for the vendor's forensic report.
- Shrink what you keep. Anonymous-by-design systems should not hold decades of tip text. Set retention limits, purge closed tips, and strip or tokenize identifiers that tipsters volunteer, especially reward-payment and banking data, which should be stored separately from tip content.
- Audit the vendor's anonymity and security claims. Ask any cloud tip, case-management or court platform vendor for current penetration test results, encryption-at-rest details (including who holds the keys), tenant isolation design and breach notification SLAs. A platform marketed as "anonymous" should be able to prove it.
- Meet your breach obligations. Canadian organizations should run the PIPEDA real-risk-of-significant-harm assessment, notify the OPC and affected people as soon as feasible, notify partners who can reduce harm (such as police), and keep breach records for two years. Check provincial requirements as well.
- Patch, don't just filter. In the parallel PeopleSoft campaign, WAF rules that match literal paths were bypassed with percent-encoding. Treat WAF blocks as a temporary measure, normalize and decode request paths before matching, and apply vendor fixes quickly.
- Monitor for leaked data in the wild. Track the leaked dataset on leak sites and in hacktivist channels. Flag any of your case numbers, informant identifiers or staff details that appear, and watch for social engineering or retaliation attempts that use them.
Sources: More than 1.5 million Canadian Crime Stoppers tips leaked, CBC excl... | Ontario court records accessed in cybersecurity breach CBC News | Canadian arrested in FBI hack that exposed employees’ personal data... | Data breach exposes 1.5 million Canadian Crime Stoppers tips, compr... | Crime Stoppers of Oregon dissolves Sept. 30 after 43 years Rose Ci... | Privacy Breach Reporting in Canada: What PIPEDA Requires | FBI Data Breach Analysis: ShinyHunters Exploit Oracle PeopleSoft Ze... | ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks – C...