Seven Months to Admit the Anonymous Tip Line Wasn't Anonymous

"Until we have a safer way to protect you, please do not send us tips by phone, online, or through the app."

That's Toronto Crime Stoppers, on October 21, telling the public to stop using the one service it exists to provide. A Crime Stoppers program asking people not to report crimes. It also said it was "deeply sorry" that its promise of anonymity had been broken for some of the people who trusted it.

Two days later, on October 23, the company behind the software finally said it out loud. Navigate360, which owns P3 Global Intel, the tip platform used by Crime Stoppers groups, police departments and schools, confirmed that hackers broke into one of its systems and copied months' worth of data. Its statement says names, addresses, dates of birth, Social Security numbers and other sensitive information may have been exposed.

The hack was claimed in March. That's seven months.

What was taken

In March, a hacker group calling itself "Internet Yiff Machine" said it had broken into P3 and taken 93 GB of data, including about 8 million confidential tips. Malwarebytes reported at the time that the records covered 1987 through 2025 and came from Crime Stoppers programs, law enforcement agencies, schools and parts of the U.S. federal government. The group handed the data to Straight Arrow News, which verified parts of it by contacting people listed in the records, and the leak archive DDoSecrets got a copy too.

The reported contents are about as bad as it gets for a tip line. Names, addresses, phone numbers and license plates of people named in tips. Tipsters who were promised anonymity but typed their own details into the form anyway. And, according to the reporting, the unencrypted message IDs and passwords tipsters used to check back on their submissions.

Navigate360 still hasn't confirmed the 8 million figure.

What the company said, and when

When the claim surfaced in March, Navigate360 said it was investigating "whether we have experienced an incident." CEO JP Guilbault told Straight Arrow News, "To this point, we have not confirmed that any sensitive information has been accessed or misused." The P3 system stayed up.

Toronto Crime Stoppers has since published its own timeline, and it's worth reading slowly. In March, it says, Navigate360 acknowledged that hackers got into P3 with a stolen customer login, but maintained the system was safe. In April, Navigate360 told Toronto its data wasn't taken. On June 9, Toronto learned its data had leaked: 176,859 tips submitted between January 2022 and November 2025, plus 14,973 names found in those tips. When Navigate360 finally offered that list of names, it didn't say whether they belonged to tipsters, suspects or someone else. So the charity couldn't even tell who was in danger.

Toronto isn't alone. Officials in Nevada and Canada told Reuters that Navigate360 has given them only partial information despite repeated requests. Police forces in Ontario suspended their use of the service after a CBC report found that hundreds of thousands of Canadian tipsters had been exposed. Portland's police bureau was already asking residents to "temporarily refrain" from using the platform back in March.

Reuters asked Navigate360 about the timing of its announcement. The company didn't respond.

Anonymity was the product

Most breach stories follow the same script, and most of us have stopped reading them closely. A retailer loses some card numbers, you get a letter, maybe a year of credit monitoring, you change a password and move on. Slow disclosure in those cases is still bad, but the damage is mostly money.

This is different. P3's own marketing told tipsters their identity "will remain anonymous at all times." That promise is the whole reason someone picks up the phone or opens the app instead of calling a detective directly. People report the neighbor, the coworker, the ex, the guy dealing out of the apartment downstairs, because they've been told nobody will ever connect the tip back to them. Some of those people live next door to the person they reported.

When a vendor sells anonymity and loses it, every week of silence is a week the person in that tip doesn't know they need to be careful. Saying it was investigating "whether we have experienced an incident" in March, telling a customer in April that its data is fine, and handing over an unlabeled list of names in the fall isn't disclosure. It's a company protecting itself while the people it promised to protect find out from the news.

It's also a good reminder of what "the cloud" means in practice. Nearly four decades of tips, from Crime Stoppers chapters, police departments, schools and federal agencies, sitting in one company's systems, reachable with one stolen login. The tipster never chose that. The schools and Crime Stoppers chapters probably never thought hard about it either. They bought a service that said anonymous, and they believed it.

If you've submitted a tip, or plan to

Malwarebytes put together practical advice back in March, and it holds up:

If you've used a P3-powered tip line, change any password you reused there, turn on two-factor authentication wherever you can, and be suspicious of anyone who contacts you about a tip. Toronto Crime Stoppers says it will never ask for a tip number or password, and that anyone who does isn't them.

If you report something anonymously in the future, assume the system can see more than it says. Use a privacy-focused browser and a VPN, leave out details that point back to you ("my neighbor," "my boss"), skip contact fields you don't want tied to the tip, and strip the location and device data from any photo or video before you upload it.

And if you're in danger, call 911.

An anonymous tip line that can't keep a tipster anonymous is worse than no tip line at all, because people trust it with things they'd never say out loud. Navigate360 had that trust, and took seven months to tell anyone it was gone.

---

Sources: Reuters via Insurance Journal · KSL · CP24 · Malwarebytes