TechReview
Cybersecurity

Toronto Crime Stoppers Pauses Tips After 1.5 Million Tips Leaked

Published By Shivam Sharma7 min read
Toronto skyline with the CN Tower, illustrative photo for the Toronto Crime Stoppers breach

Toronto Crime Stoppers has stopped accepting anonymous tips by phone, online, and through its app, after a March 2026 breach of the P3 tip-management platform exposed more than 1.5 million Canadian Crime Stoppers tips. The Toronto Crime Stoppers breach matters because the product being sold was anonymity itself, and the organisation has now said it can no longer guarantee it. Its public message, quoted by Malwarebytes, reads: “Until we have a safer way to protect you, please do not send us tips by phone, online, or through the app.”

What Toronto residents should do right now

During the pause, non-emergency reports in Toronto should go directly to Toronto police, whose channels are not anonymous. Anyone in immediate danger should call 911. There is no confirmed individual notification route: the Toronto statement did not describe a process for checking whether a particular tip was affected, and it did not offer a way to look one up. Toronto Crime Stoppers warned people worried about exposure to watch for impersonators, and said it will never contact them first to request a tip number, password, or other information. Treat any message that does so as a scam. Our guide on what to do when 911 will not connect is here: What to Do If 911 Won’t Connect.

How the Toronto Crime Stoppers breach happened

The platform is P3 Global Intel (P3), a tip-management platform owned by Navigate360, a Texas-based company. Its software is used by Crime Stoppers programs and other organisations in the US and elsewhere. Data was stolen from P3 in March 2026. Toronto Crime Stoppers says Navigate360 told it in April 2026 that Toronto’s data had not been taken, then told it in June 2026 that Toronto data was affected, without at that point saying what was exposed. Toronto says it still had not received the text of the stolen tips despite months of requests. The pause was announced on Wednesday 21 October 2026, in a statement from Toronto Crime Stoppers chair Sean Sportun, following CBC’s reporting that week. Sportun apologised and said the organisation’s promise of anonymity had been broken for some tipsters.

The wider fallout is still spreading. Crime Stoppers of Grey Bruce also suspended tip collection late on Thursday 22 October 2026. A CBC correction says two Crime Stoppers programs (Toronto, Guelph Wellington) had paused, and at least six police units had paused partnerships, including Toronto, York Region, Halton, Hamilton, and Windsor. Waterloo Regional Police had stopped promoting Crime Stoppers in July, according to CBC’s reporting. Toronto Police Service has temporarily suspended its use of Crime Stoppers while it reviews the breach. No source gives a date for when tip intake will resume.

Two counts that cannot be compared

CBC’s analysis of the leaked data, as reported by Malwarebytes and MobileSyrup, found more than 1.5 million tips submitted to Canadian Crime Stoppers programs over about 25 years were exposed, and more than 850,000 of those tips contained personal information. Reported data types include addresses, phone numbers, email addresses, licence plates, and hundreds of banking details tied to cash rewards. The people affected include tipsters, people named in allegations, police, and Crime Stoppers staff. CBC found more than 4,300 reports in which tipsters gave their full names, and hundreds of cases where staff had flagged that a tipster had “self-identified” or been “exposed”, with the details still present unredacted. CBC also found nearly 49,000 tips linked to cases cleared by arrest or charge, and nearly 1,000 tipsters approved for cash rewards.

Toronto’s own figures describe something different, and the difference matters. Navigate360’s Toronto figure is 12,392 tips that “may contain personal information”, out of 176,859 Toronto tips submitted between January 2022 and November 2025. The two counts cannot be compared directly: CBC’s count covers about 25 years of tips from programs across Canada and counts personal information actually found in the leaked text, while the vendor’s count covers Toronto only, January 2022 to November 2025, and counts what the vendor flagged as potentially personal. EconoTimes makes the same point, noting the CBC analysis covered a broader set of records over a longer period, so its figures are not directly comparable with Toronto’s count. This article therefore reports both counts separately, with their own attributions, and does not divide one by the other. The story that survives that correction is the delay: Toronto says it still had not received the text of the stolen tips, seven months after the March breach, despite months of requests.

Two figures must not be merged. Navigate360 separately supplied a list of about 14,973 names linked to the affected tip numbers, without saying whether those names belong to tipsters, people named in tips, or both. One conflicting account, from TorontoToday, says the 12,392 figure itself grew to about 14,980 by September, which would make the names list a revision of the same count rather than a separate list. The two accounts conflict, so this article reports both with their own attributions and does not combine them into one affected-people total. The 8.3 million figure seen in some coverage is the total raw leaked dataset, not a count of confirmed victims, and it is not a US figure.

Read also: our data breach tracker, which lists the other confirmed incidents we cover. The other incidents on that page are unrelated to this breach.

Who is affected, and what is still unconfirmed

Confirmed: the pause, the March 2026 breach, the April “not affected” message followed by the June “affected” message, the Toronto and Canadian counts above, and the police pauses. No individual notification route has been confirmed, and no resume date has been given. Authorities have said they have not received reports of anyone being threatened: the RCMP told CBC it had not received reports of anyone being threatened, and Toronto Police said it had not received information indicating the safety of officers, tipsters, or the public had been compromised. Those are statements, not proof that no harm occurred.

Separately, Toronto Crime Stoppers’ own timeline records that Navigate360 confirmed on 25 March 2026 that someone entered P3 using a stolen customer-account login. That is the organisation’s account of what the vendor told it, not an independent finding. Claimed, not confirmed: MobileSyrup, reporting CBC, says the data was stolen in March by hacktivist group Internet Yiff Machine, which claimed it wanted to expose vulnerabilities in the platform, and that US non-profit Distributed Denial of Secrets made the data available to researchers and journalists including CBC. US senators cited reports of exploited platform vulnerabilities. No specific vulnerability or CVE has been published, and the accounts are different and unresolved, so this article does not present them as a single confirmed method. A vendor remediation claim, that third-party experts “identified vulnerabilities and completed remediation”, comes via a national association statement and is not independently confirmed. Risk language about retaliation, intimidation, extortion, and scam impersonation is framed by Malwarebytes as risk, not as confirmed incidents, and no source reports a confirmed retaliation case.

The US angle needs stating plainly, because this is a Canadian-centred story. The vendor is US-based (Navigate360, Texas), P3 is used by US Crime Stoppers programs and other US organisations, and the Portland, Oregon police bureau advised residents in March 2026 to temporarily refrain from submitting tips through the Crime Stoppers platform. No confirmed US victim or tip count was found in any source covering the Toronto Crime Stoppers breach, and this article does not present one.

What to watch next

Five questions will decide how this ends. Whether Toronto publishes a notification or lookup process for past tipsters, and whether other chapters follow Toronto into a full pause or reopen first. Whether Navigate360 explains the 12,392 and 14,973 counts, and the reported September revision to about 14,980, and whether it names the vulnerability or confirms the stolen-login account. Whether any confirmed retaliation or impersonation case emerges, which would turn framed risk into documented harm. And whether US programs using P3 disclose their own exposure, since the vendor and the platform are American even though the confirmed counts so far are Canadian.

Sources

Related reviews and guides