Crime Stoppers faces class action over leak of 1.5 million 'anonymous' tips

A Canadian law firm has proposed a class action against the Canadian Crime Stoppers Association and its US contractor Navigate360 over a hack that exposed more than 1.5 million tips Canadians had sent to the anonymous crime line. Consumer Law Group announced the suit on 30 October, Daily Hive reported. The lead plaintiff is a resident of Dunnville, Ontario, who gave Crime Stoppers his name, address, phone number and email when he reported a suspected drug house near his home.

What leaked and how it came out

Crime Stoppers is a network of non-profits that passes tips about crimes to police and promises callers anonymity. Its chapters store tips on P3, a platform run by Navigate360. A hacktivist group calling itself Internet Yiff Machine stole the data in March, saying it wanted to prove the platform was not as "anonymous" and "secure" as advertised. The non-profit Distributed Denial of Secrets later gave a copy to journalists and researchers.

On 21 October, CBC News published its analysis of the Canadian part of the dataset: more than 1.5 million tips from over 60 chapters, going back 25 years, with personal details in more than 850,000 of them. CBC could not always tell whether those details belonged to a tipster, a victim or a suspect. The details were enough for reporters to reach more than a dozen tipsters, some of whom said they feared retaliation. The RCMP said the breach could put tipsters, people named in tips and police officers at risk, and added that it had first been told no Canadian data or personal information was involved.

Navigate360 confirmed the breach publicly on 23 October. It said an unauthorized party copied data from one of its systems between 21 November 2025 and 5 March 2026, and that it had no evidence the information had been used for fraud or identity theft. Toronto Crime Stoppers said the company told it about the leak on 18 March and called the system "safe and fully operational" a week later, and that the company's account of what was taken changed several times over the following months.

What the lawsuit claims

According to the proposed claim, Crime Stoppers and Navigate360 left personal data unredacted and unencrypted and kept decades of records long after they were needed. It alleges that the exposed data included home addresses, phone numbers, licence plates, banking details and Social Insurance Numbers, as well as information about people named in tips, staff and police. It also accuses Navigate360 of knowing about the suspicious activity from 18 March but not notifying affected people or the public until October. None of these claims has been tested in court, and the class has not been certified.

Police pull back, regulators are limited

By 27 October, CBC counted at least 11 Crime Stoppers programs that had paused taking tips, including all five in Saskatchewan, and 24 police services that had suspended their partnership. Others still use it: the Calgary police told Global News on 30 October that they were satisfied with the additional security measures, and some RCMP detachments kept promoting the program.

On 27 October, Privacy Commissioner of Canada Philippe Dufresne opened an investigation into the safeguards Navigate360 had in place. He cannot investigate Crime Stoppers itself: the federal private-sector privacy law generally does not cover non-profits, and Ontario's commissioner oversees only the public sector. CBC also obtained a June memo in which the association's president told chapters they should not contact privacy commissioners. University of Ottawa law professor Michael Geist told CBC that people who want compensation will have to rely on class actions, because current privacy law offers them little.