What happened
A CBC News investigation published October 21, 2026 found that more than 1.5 million tips sent to Canadian Crime Stoppers programs over 25 years were stolen from P3, the tip platform run by U.S. company Navigate360; CBC counted more than 850,000 tips with identifying details. A hacktivist group took the data in March 2026, and Navigate360 first confirmed publicly on October 23 that its database was breached between November 2025 and March 2026. Toronto, Ottawa, Winnipeg, Hamilton, London and other police services, plus Saskatchewan chapters, have paused Crime Stoppers tips. (CBC News, Oct. 23, 2026)
Note on figures: Tip counts come from CBC's analysis of a copy of the stolen data; Navigate360 says it has no evidence of misuse for fraud or identity theft.
What it means for Canada
This is a documented Canadian breach. Tipsters, victims and accused people named in tips may be identifiable, and police lost an anonymous reporting channel. CBC reports that the federal Privacy Commissioner says PIPEDA generally does not apply to not-for-profit Crime Stoppers chapters, and Ontario's IPC says it lacks authority, so regulators cannot formally investigate the chapters. The lesson for Canadian businesses is that handing personal data to a foreign SaaS vendor does not hand off responsibility for it.
- Sectors
- Policing and public safety · Not-for-profits · Any organization using a U.S. SaaS vendor for sensitive data
- Tools involved
- Navigate360 P3 tip platform
- Canadian rules
- PIPEDA accountability principle: an organization stays responsible for personal information it transfers to a third party for processing
PIPEDA breach reporting to the OPC and notice to affected people when there is a real risk of significant harm (commercial organizations)
Quebec Law 25 privacy impact assessment before sending personal information outside Quebec
Gap: PIPEDA generally does not cover not-for-profits, per the OPC
Takeaways for Canadian businesses and individuals
- BusinessList every outside vendor that stores sensitive personal data for you and confirm in writing how long it keeps records, whether they are encrypted and de-identified, and how many hours it has to notify you of a breach.
- BusinessSet retention limits so vendors delete old records; 25 years of tips were exposed here because nothing was purged.
- BusinessIf you are subject to PIPEDA and a vendor breach touches your customers, assess real risk of significant harm and report to the Office of the Privacy Commissioner, notify affected people, and record the breach, even though the vendor caused it.
- IndividualsPolice say to send tips directly to your local police non-emergency line, or call 911 for emergencies, until Crime Stoppers resumes.
- IndividualsIf you once gave Crime Stoppers your name or contact details, watch for targeted contact or identity misuse and report fraud to the Canadian Anti-Fraud Centre (1-888-495-8501).
For the Canadian AI sector
Not an AI incident, but every Canadian AI and SaaS buyer faces the same vendor question: how is data encrypted, de-identified and retained, and how fast will the vendor tell you about a breach? Navigate360 took seven months to confirm this one publicly.
Written by AgentsNorth from the source below. General information, not legal or security advice.