Toronto Crime Stoppers Halts Tips After P3 Breach Exposes 176K

"Since 1984, people in Toronto have come to Toronto Crime Stoppers because we promised they could stay anonymous." That is how the charity's chair, Sean Sportun, opened a statement dated October 21, 2026. The next sentences admitted that for some of those people, the promise was broken. "We are deeply sorry."

Toronto Crime Stoppers is now closed to tips by phone, web and app. The cause is a March breach of P3, the tip software sold by Navigate360, and a vendor that spent months saying the damage was smaller than it was. If you ever reported someone through an "anonymous" form, this story is about you.

Key Takeaways

• Navigate360 told Toronto Crime Stoppers that 176,859 of its tips, submitted between January 2022 and November 2025, were in data stolen from the P3 platform, along with 14,973 names whose owners it did not identify.
• Toronto Crime Stoppers paused all tip intake on October 21, 2026, and directed both Navigate360 and the National Anonymous Call Centre to stop handling tips meant for it.
• CBC, working from data obtained through Distributed Denial of Secrets (DDoSecrets), reported that more than 1.5 million Canadian Crime Stoppers tips were exposed and that about half of the tips it studied contained personal information.
• Toronto removed identifying details only before tips reached investigators, so the original, unredacted submissions stayed on the vendor's platform where the attackers found them.
• The hacktivist group Internet Yiff Machine claimed the March breach, and Navigate360 has said the attacker got in with a customer account's stolen login.

What Happened to Toronto Crime Stoppers?

Toronto Crime Stoppers stopped taking tips because its vendor lost years of original submissions and still has not shown the charity what they say. Its own timeline:

• March 18 to 19: reports surface that P3 was hacked. Navigate360 tells programs it has not confirmed an incident.
• March 25: Navigate360 confirms someone accessed P3 using a customer account's stolen login, but calls the system "safe and fully operational."
• April 9: Navigate360 says some Canadian programs lost data, but not Toronto.
• June 9: Navigate360 reverses itself. Toronto's data was affected.
• July 6: Navigate360 hands over the ID numbers of 176,859 stolen tips and says 12,392 of them "potentially" contained personal information.
• September to October: it supplies roughly 14,973 names tied to those tips, without saying whether they belong to tipsters, suspects or anyone else.
• October 21: media reports land; Toronto pauses intake.

"Since March, Navigate360 has told us repeatedly that P3 is secure," the statement says. Toronto's lawyers have made repeated requests for the text of the stolen tips, and as of the statement, Navigate360 had not provided it. The Record reported that Navigate360 did not immediately respond to a request for comment. Toronto police have also suspended their use of the tip line while a review is conducted.

How Big Is the P3 Breach?

The full P3 dataset is far larger than Toronto's slice. In March, Straight Arrow News reported that it and DDoSecrets had obtained more than 8.3 million records spanning February 1987 to November 2025, supplied by a group calling itself the Internet Yiff Machine. DDoSecrets said it would share its copy with vetted journalists and researchers rather than post it publicly. At the time, Navigate360 CEO JP Guilbault said the company had "not confirmed that any sensitive information has been accessed or misused."

CBC's October investigation put numbers on the Canadian share. According to The Record, about half of the 1.5 million leaked tips CBC studied, some dating back 25 years, contained personal information. Malwarebytes, summarizing the CBC findings, lists addresses, phone numbers, email addresses and some banking details tied to reward payments, belonging to tipsters, the people they named, and in some cases police and Crime Stoppers staff.

Toronto's 176,859 stolen tips equal about 12% of the 1.5 million Canadian tips CBC examined. The 14,973 names work out to one for roughly every 12 Toronto tips. And Toronto went 61 days, from April 9 to June 9, believing its data was safe because the vendor said so.

Why Did Anonymous Tips Expose People?

Anonymous tips exposed people because the anonymity was a policy applied after storage, not a property of the system. Toronto's statement explains the gap plainly: "We never ask for your name, and we don't want it. But people sometimes include details to explain what they saw." Staff removed those details before a tip went to investigators. The originals stayed on P3.

Most coverage frames this as a hack. The deeper failure is design. Redaction protected tipsters from the police officer reading the summary. It did nothing against an attacker holding a stolen login to the vendor's database. A system that keeps the raw text of every tip in one cloud platform has a single point of failure, and here it failed for up to 25 years of submissions at once.

P3's own feature set shows the same thing. Straight Arrow News found P3 sales material promising that "each tipster's identity will remain anonymous at all times," alongside an opt in feature called "Session Information Disclosure" that lets P3 customers request tipsters' IP addresses. SAN reported the feature is disabled by default and the values are stored for up to 90 days. A toggle is a setting someone can change. Our July coverage of how age verification threatened anonymous whistleblowing turned on the same question: is anonymity enforced by architecture, or only by a promise?

What Does a Tip Reveal Before You Write a Word?

Every tip channel leaks something about the sender, even when nobody asks for a name. The main exposures:

• Web forms: the server sees your IP address, which can point to your home or workplace. P3's Session Information Disclosure feature shows that a tip platform can capture it.
• Email: your address, your provider, and headers that record when and how the message was sent. Our guide to what your email metadata reveals walks through each field.
• The text itself: "I saw it from my balcony," a shift time, a car only you would recognize. Toronto's statement confirms these details are exactly what ended up in the stolen originals.
• Attachments: photos and documents can carry metadata such as device model, author name and location.

Compare that with SecureDrop, the open source submission system used by news organizations. Its documentation says sources connect over the Tor network, and that "The SecureDrop application does not record your IP address, information about your browser, computer, or operating system." Submissions are decrypted on a Secure Viewing Station, "a machine that is never connected on the Internet," where journalists can strip metadata. No admin toggle can hand over an IP address the system never received. That is anonymity by design.

Why Email Users Should Care

Email addresses are part of the leak. Tipsters who left an address to follow up or collect a reward are now in a dataset that pairs that address with what they reported. Malwarebytes warns that scammers could use details of a genuine tip to make an approach more convincing. A message that quotes your own tip back to you is a powerful lure for extortion or phishing.

Toronto Crime Stoppers has drawn a clear line: "We will never contact you first to ask for your tip number, password, or anything else. If someone does, it isn't us." Treat any email claiming to be from Crime Stoppers, Navigate360 or P3 about your tip as hostile until proven otherwise. If you need to send sensitive information by email in the future, our guide on how to send an anonymous email covers Tor access, fresh accounts and the slip ups that unmask people.

How Can Tipsters and Sources Protect Themselves Now?

Toronto has not offered a way to check whether a specific tip was affected. These steps apply to any sensitive report:

1. Do not send tips to Toronto Crime Stoppers right now. The charity asks you not to. Call 911 if someone is in danger. Non emergency reports can go to Toronto Police Service, which the statement acknowledges is not anonymous.
2. Ignore anyone who contacts you about your tip. Never confirm a tip number or password.
3. Check your local program. Other Crime Stoppers programs ran on P3 too. Look for updates on your program's official website before sending anything.
4. Write tips that describe the event, not your vantage point. Drop where you were standing, how you know the person, and anything only you could have seen. Assume the raw text will be read by someone other than its intended recipient.
5. Strip file metadata. Remove location and author data from photos and documents before sharing them.
6. For high stakes leaks, use a newsroom's SecureDrop. Its source guide says: "DO NOT access SecureDrop on your employer's network," and not from your employer's hardware either.

What Happens Next?

Toronto says it has worked with partners since June on "a safer way to take tips" and will post updates at 222tips.com. Any future vendor, it says, will have to delete what is not needed. Tipsters still do not know what the stolen text says or whose names are on the list of 14,973. As Global News reported, Sportun says the name list alone "lacks detail necessary to measure the risk involved." Until the vendor answers, plan as if your words are already out.

In the UK, the police inspectorate found that suppliers holding police data were repeatedly breached with little ongoing oversight.