US school and public-safety company Navigate360 publicly acknowledged on Friday, October 23, 2026, that hackers broke into one of its systems and copied months' worth of data, according to Reuters reporting carried by CNA. The admission comes seven months after a hacker claimed in March to have stolen 93 GB from its tip-intelligence subsidiary, P3 Global Intel, including what they said were 8 million confidential tips. Editorial note: this is not a separate incident. It is the same underlying breach behind the Canadian Crime Stoppers exposure wasteland.me covered on October 21. Navigate360 and P3 are the vendor that ran the platform, and Crime Stoppers chapters are its downstream customers. The new development is the vendor's own confirmation and its disclosure that names, addresses, dates of birth and Social Security numbers may have been exposed.
What Happened
The timeline below is assembled from the sources. Navigate360 has not published its own, and it did not answer Reuters' questions about the timing of its announcement.
- March 2026: A hacker calling themselves "Internet Yiff Machine" claimed to have breached P3 Global Intel and taken 93 GB of data (CNA/Reuters). The data was later made available to journalists by Distributed Denial of Secrets (DDoSecrets), according to The Record. At the time, Navigate360 said only that it was investigating "whether we have experienced an incident."
- March to April: Toronto Crime Stoppers says Navigate360 told it from March onward that the platform was secure, and in April said Toronto's data had not been taken (Toronto Crime Stoppers statement via CP24, cited by Cybersecurity Canada).
- June: Navigate360 told Toronto Crime Stoppers that its data had in fact been affected. Waterloo Regional Police say they learned of the incident in late June and later got confirmation that Waterloo Regional Crime Stoppers was affected.
- Early July: Waterloo Regional Police stopped promoting Crime Stoppers as a way to report crime.
- October 21: CBC published an investigation finding that more than 1.5 million Canadian Crime Stoppers tips were in the leaked data.
- October 22: Toronto Crime Stoppers broke ranks with the national association. It released its own timeline, paused its tips program, and told Navigate360 to stop taking and processing tips. Peel Regional Police suspended their participation in the program the same day.
- October 23: Kingston Police said they had stopped using Crime Stoppers as a reporting channel. Navigate360 issued its public acknowledgment.
CNA/Reuters reports that officials in Nevada and Canada have said Navigate360 gave them only partial information despite repeated requests. Several police services (Waterloo, Peel, Kingston) say the P3 platform is not connected to their own IT systems. They are sending scope questions to Navigate360 and the Canadian Crime Stoppers Association. Peel Regional Police describe the incident as affecting Crime Stoppers organizations in both Canada and the US.
What Was Taken
Reported figures vary widely, and they measure different things. None of them comes from a primary source:
- Total tips: the hacker claimed 8 million confidential tips and 93 GB of data (CNA/Reuters). Navigate360 has not confirmed a total count.
- Canadian tips: CBC's analysis of the leaked data found more than 1.5 million tips submitted to Canadian Crime Stoppers programs over about 25 years. About half included personal information.
- Canadian tipsters affected: accounts differ. CNA/Reuters says "hundreds of thousands" of Canadian tipsters were exposed. CBC's own reporting says "tens of thousands." The gap may come from whether people named in tips are counted alongside the people who submitted them, but the sources don't say.
- Toronto alone: Toronto Crime Stoppers says Navigate360 confirmed that 176,859 tips submitted between January 2022 and November 2025 were stolen, and that they contained 14,973 names. Navigate360 has reportedly not told Toronto whether those names belong to tipsters, to people accused in tips, or to both (CP24/CityNews via Cybersecurity Canada).
- Data types: Navigate360's statement lists names, addresses, dates of birth, Social Security numbers "and other sensitive information" as potentially exposed. CBC separately found names, home addresses, phone numbers and email addresses in the Canadian tips. The mention of SSNs points to US individuals being affected beyond the Canadian population.
There is also an unresolved conflict about how far back the data goes. Navigate360 describes "months' worth of data," but CBC found Canadian tips going back about 25 years.
Why It Matters
This may be one of the most consequential vendor breaches of the year because of who was exposed. Anonymous tip lines only work if they keep their promise of anonymity. CBC was able to reach more than a dozen tipsters directly from the leaked data, and some of them now fear retaliation from the people they reported. University of Ottawa law professor Michael Geist called it "potentially one of the most harmful data breaches we've ever seen in Canada." He noted that under Canadian law the collecting organization stays accountable even when a subcontractor holds the data, but that enforcing that against a US-based vendor is hard and penalties are weak.
The damage to operations has already spread. Toronto Crime Stoppers has paused, Ontario police services have suspended or stopped promoting the program, and the public has been sent to channels that are not anonymous. For defenders, the more important lesson is about the disclosure chain. Customers relied on the vendor's reassurances for months, at least one of them was told its data was safe when it was not, and the vendor's public confirmation came only after journalists had analyzed the leaked data themselves.
The Attack Technique
No source describes how the attackers got in. Navigate360's statement, as reported, says only that hackers "broke into one of its systems" and copied data. No initial access vector, vulnerability, credential compromise or dwell time has been disclosed. We know the following:
- The data was taken as a bulk copy (93 GB, according to the hacker) rather than encrypted for ransom. No ransomware or extortion demand has been reported.
- The person claiming the attack, "Internet Yiff Machine," announced it publicly, and the dataset reached DDoSecrets. That suggests hacktivist-style leaking rather than a financially motivated sale.
- The size of the Canadian data and the 25-year span CBC found suggest the attackers reached a central multi-tenant tip store, not a single customer's instance.
We will update this section if Navigate360 or investigators disclose the technique.
What Organizations Should Do
- Assume confidential intake data is the crown jewel. Whistleblower, tip-line, ethics-hotline and HR-complaint platforms hold data that can lead to physical harm if exposed. Classify them as the highest tier in vendor risk assessments, whatever the contract is worth.
- Write breach-notification terms into vendor contracts. Require notification within fixed timelines, written scope determinations, and the right to an independent forensic summary. Toronto's experience (told "secure," then "not taken," then "affected") shows why verbal reassurance is not enough.
- Minimize and expire what the vendor retains. Tips going back 25 years should not sit in a live SaaS store. Enforce retention limits, purge resolved records, and avoid collecting identifiers that the program's design does not need.
- Check vendor tenancy and segregation. Ask whether your data sits in a shared database with other customers', how it is encrypted at rest, and who holds the keys. The breach of one vendor system exposed several countries' worth of customers.
- Prepare a vendor-compromise playbook ahead of time. Decide in advance when to suspend intake, how to send the public to other channels, and how to notify affected people when the vendor won't give you a scope.
- If you are a P3 or Navigate360 customer, formally request the specific records and fields stolen from your tenant, then work out whether exposed people need safety outreach as well as credit monitoring.
Sources: Safety company acknowledges hack seven months after breach exposed... | Toronto Crime Stoppers pauses program after CBC exclusive finds ove... | Crime Stoppers had 'potentially one of the most harmful ... | Toronto crime tips org freezes operations after details of data bre... | Waterloo Regional Police Service’s Statement Regarding Crime Stoppe... | Third-Party Vendor Data Breach: Lessons from the Crime ... | Peel Regional Police Statement on the Crime Stoppers Data Breach P... | Kingston Police Statement on Crime Stoppers Kingston Police