Devastating Data Breach at Crime Stoppers Across Canada Exposes Tipsters and Their Personal Information.

Two days after a prominent Toronto news portal revealed the extent of the Crime Stoppers data breach in Canada, experts are now considering the long-term implications of what could be one of the country’s most severe privacy failures.

“It strikes me as potentially one of the most harmful data breaches we’ve ever seen in Canada,” said Michael Geist, a law professor at the University of Ottawa and the Canada Research Chair in Internet and E-commerce Law.

Under Canadian law, Geist said both Crime Stoppers, the organization that collected the data, and Navigate360, the company it hired to manage the data, could be held accountable.

The breach centers on Navigate360 and its tip-management platform, P3. All Crime Stoppers chapters, including those in Canada and the U.S., relied on P3 to keep their data anonymous.

The information was stolen by a hacking group known as Internet Yiff Machine in March 2025. After the hack was uncovered, they claimed they wanted to disprove the company’s assertions that its platform was “anonymous” and “secure.”

Investigators who examined a copy of the hacked data found that over 1.5 million tips submitted to Canadian Crime Stoppers programs over the last 25 years were exposed, along with tens of thousands of unredacted personal details.

Adding to the controversy are inconsistent statements from the Toronto and Guelph Wellington Crime Stoppers chapters about how much data was stolen and what was affected.

Earlier this week, the Toronto chapter said Navigate360 initially told them no Canadian data had been taken, then claimed Toronto was not impacted, before finally revealing that years of Toronto data had been compromised. The Guelph Wellington chapter of Crime Stoppers issued a similar statement the following day.

As a result, police services across Ontario and other parts of Canada have suspended their use of Crime Stoppers.

Meanwhile, privacy experts caution that tipsters whose information has been leaked may have limited options for justice.

“In terms of actual compensation for the affected individuals, current privacy law doesn’t really address that,” the experts noted. “Individuals may need to consider other avenues, such as class action lawsuits, if they are seeking compensation.”