Crime Stoppers breach: federal and B.C. privacy commissioners open investigations

When we wrote about the Crime Stoppers tips leak on October 26, the federal and Ontario privacy commissioners had said they couldn’t formally investigate, because the federal private-sector law generally doesn’t cover non-profits like Crime Stoppers. That has changed. Two privacy regulators have now opened investigations, from different angles. Here’s what each one is looking at and what it means if you ever sent a tip.

A quick recap

Crime Stoppers chapters across Canada used P3 Global Intel, a tip platform owned by the U.S. company Navigate360, to collect anonymous tips. A hacktivist group calling itself Internet Yiff Machine said in March 2026 that it had broken in. CBC News found more than 1.5 million Canadian tips in the stolen data, going back 25 years, and more than 850,000 of them held personal details such as street addresses and phone numbers.

In an October 23 statement quoted by Global News, Navigate360 said it became aware of the incident on March 18, that a third party copied some data between November 21, 2025 and March 5, 2026, and that names, addresses, dates of birth, Social Security numbers, phone numbers and email addresses may have been affected, depending on the person. It said: “We have no evidence of misuse of any personal information for fraud or identity theft.”

The federal investigation: Navigate360’s safeguards

On October 27, Privacy Commissioner of Canada Philippe Dufresne opened an investigation into Navigate360, the commercial company that provides and manages the platform. It will look at the security safeguards Navigate360 had in place at the time of the breach, to decide whether it complied with PIPEDA, Canada’s federal private-sector privacy law.

That is how the federal office got around the gap we described. PIPEDA generally doesn’t apply to non-profits, and Crime Stoppers is one. But Navigate360 is a business that handled the tips commercially, so its safeguards fall under the law. The office says it has also offered Crime Stoppers guidance on responding to the breach and contacted Navigate360 about containment, reducing the risk to people affected and preventing future breaches.

The B.C. investigation: B.C. Crime Stoppers itself

On November 3, B.C.’s Information and Privacy Commissioner announced that it is investigating whether the British Columbia Crime Stoppers Society took adequate steps to protect personal information gathered from people who reported tips in B.C.

B.C. can do what the federal office couldn’t, because B.C.’s private-sector law, PIPA, covers organizations including non-profits that handle the personal information of people in B.C. PIPA requires organizations to make reasonable security arrangements to protect personal information they hold.

The commissioner also said something that matters for tipsters directly: because the information is so sensitive, people who think they were affected don’t need to file a complaint. The office says it can’t share more while the investigation is open.

CBC reports that B.C. Crime Stoppers has 15 volunteer chapters in the province, and that Metro Vancouver Crime Stoppers has asked people not to submit tips through its program until further notice, pointing them to local police instead. It said: “This pause is temporary. We will begin accepting new tips as soon as we are confident it is safe to do so.”

What we still don’t know

• Neither regulator has said when it expects to finish.
• Toronto Crime Stoppers said 176,859 of its tips were affected, 12,392 of which may contain personal information, and that Navigate360 later supplied a separate list of 14,973 names. Its chair told Global News the list “lacks detail necessary to measure the risk involved” because it didn’t say who the names belonged to.
• There is still no plan to notify the people named in tips. The data doesn’t clearly separate tipsters from the people they reported, which makes notification risky.

What you can do

1. You don’t need to do anything to be included in the B.C. investigation. If you want to share a concern anyway, the B.C. commissioner’s office is the place.
2. If you’re worried about a tip you sent, contact your local chapter or the Canadian Crime Stoppers Association, as the RCMP has advised. If a chapter has paused tips, it will point you to local police.
3. If you feel unsafe, call your local police. In an emergency, call 911.
4. Be wary of anyone who brings up a tip you made. Crime Stoppers doesn’t call tipsters out of the blue. Hang up and call the chapter on a number you looked up yourself.
5. Make your home address harder to find. Our guide to opting out of data brokers in Canada walks through the people-search sites that publish addresses and phone numbers.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame also has step-by-step guides to opt out of the data brokers that publish home addresses and phone numbers. Frame never collects or stores the leaked records themselves.

Related coverage

• Crime Stoppers tips leak: what Canadian tipsters should know: our first look at what was stolen and why notifying people is hard.
• How to opt out of data brokers in Canada: the main sites that publish addresses and phone numbers, and how to remove yours.

Sources

• Office of the Information and Privacy Commissioner for B.C., Office of the Information and Privacy Commissioner for BC investigating Crime Stoppers breach (PDF), November 3, 2026
• Office of the Privacy Commissioner of Canada, Privacy Commissioner of Canada to investigate data breach involving Crime Stoppers, October 27, 2026
• CBC News, B.C. privacy watchdog launches investigation into Crime Stoppers data breach, November 3, 2026
• CBC News, Privacy commissioner to investigate Canadian Crime Stoppers breach, October 27, 2026
• Global News, No evidence stolen Crime Stoppers data used for fraud, provider says, October 27, 2026