Posted in

Privacy Regulator Probes Crime Stoppers Hack as Police Suspend Tip Intake

Canada's federal privacy commissioner has opened an investigation into a reported breach affecting roughly 1.5 million tips submitted to Crime Stoppers programs over 25 years. Police services in Ontario, Manitoba and Saskatchewan have temporarily stopped directing the public to the platform while the incident is reviewed.

What the investigation covers

The Office of the Privacy Commissioner, led by Philippe Dufresne, says the probe will focus on Navigate360, the U.S.-based third-party company that operates the system used by Crime Stoppers. The office will examine the security safeguards Navigate360 had in place when the breach occurred and whether the company complied with Canada's federal private-sector privacy law. The regulator has also contacted the company, though it has not said whether Navigate360 has responded.

How the breach came to light

CBC first reported that tips submitted to Canadian Crime Stoppers programs were exposed when Navigate360 was hacked in March. The company later confirmed the breach, saying it opened its own investigation, took mitigation measures and added enhanced safeguards with the help of another cybersecurity firm. The exact scope of the exposed data has not been fully detailed in the material available.

Effect on police and the public

  • Several police forces across Ontario, including some in the Greater Toronto Area, temporarily stopped directing public calls to Crime Stoppers.
  • At least two Manitoba departments, including Winnipeg, said they would stop accepting tips through the program while they assess the incident.
  • Saskatchewan Crime Stoppers asked the public over the weekend to avoid submitting tips through its platform.

Each program described the pause as temporary and said it would resume once it was confident the system was safe. The privacy commissioner's office has offered Crime Stoppers programs its expertise and guidance as they respond.

What remains unclear

The investigation is at an early stage, and the regulator has not announced findings or penalties. Whether the exposed tips contained identifying information about informants, and how many individuals were affected, will be central questions as the review proceeds.