For: people who ever submitted a tip through a Crime Stoppers program in Canada or the US, people who may be named in a tip, and anyone who received a Navigate360 notice letter. This article is based on Navigate360's notice, the Privacy Commissioner of Canada's news release, a California Attorney General listing and Crime Stoppers statements, and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 30, 2026Not yet known
- Official total number of tips and people
- Which Crime Stoppers programs are covered
- What each copied tip contains
- Whether the names are tipsters, people named in tips, or both
- Results of the Privacy Commissioner's investigation
- Whether and when Crime Stoppers programs resume taking tips
Toronto Crime Stoppers says it has repeatedly asked Navigate360 for the text of the copied tips and has not received it. The Privacy Commissioner of Canada says it cannot give further details while its investigation is active.
What to do today
If you ever sent a tip: think about what could point to you
Crime Stoppers says it does not ask for names, but a tip can still contain details a person typed in, such as an email address, a phone number, or facts only you would know. Toronto Crime Stoppers says it removes identifying details before passing tips to police, yet it has not received the text of the tips, so it cannot say what was in the copied data.
Write down roughly what you reported and when. This is a reason to be careful, not proof that you were identified.
If you feel unsafe, use the police or a lawyer, not the paused tip line
In an emergency, call 911. For non-emergencies, report directly to your local police. If you fear retaliation, a lawyer or a victim-services organisation can advise on protection options. Toronto Crime Stoppers asked people not to submit new tips until a safer method exists.
Be careful with the contact details you used for the tip
If the email address or phone number you used for a tip is also your main one, treat any message that mentions a tip, a reward, or "your case" as suspicious. Email addresses can be changed; phone numbers are harder, so turn on call and text filtering (see Smartphone security basics).
Never give a tip number, password or reward details to someone who contacts you
This site's advice: do not give such details to anyone who contacts you, even someone who says they are from Crime Stoppers. A message that quotes real details of your tip is not proof it is genuine, because someone else may hold the same data (see What is phishing?).
If you received a Navigate360 notice letter (US): use the identity-theft steps
Navigate360 lists a toll-free number (833-966-1754, 9:00 a.m. to 9:00 p.m. Eastern, Monday to Friday except US holidays) and a PDF file named Steps to Protect Your Information on its notice page. We could not read that file. Because Social Security numbers may be involved, a credit freeze at the credit bureaus and regular checks of your credit reports and statements are the standard precautions (general guidance, not specific to this incident). Background: What to do when an ID document leaks.
If you are named in someone else's tip
There is no public way to find out. Do not respond to messages that claim to know what a tip said; keep a record and, if you are threatened, report it to the police.
What happened (from the published statements)
Nov 21, 2025 to Mar 5, 2026
Per Navigate360's notice, an unauthorized third party accessed a system and copied some data in this window.Mar 18, 2026 (on or about)
Navigate360 became aware of suspicious activity on one of its systems (its notice).Mar to Jun 2026
Toronto Crime Stoppers says Navigate360 told it in March that P3 was secure, in April that Toronto's data had not been taken, and in June that Toronto's data was affected (The Record). CP24 reports that Navigate360 confirmed the total number in July.Oct 22, 2026
Toronto Crime Stoppers paused accepting tips after news coverage of the breach, and Toronto Police Service suspended its use of Crime Stoppers (CP24).Date not shown
National Capital Area Crime Stoppers' notice says Ottawa Police paused participation and that it is temporarily suspending the collection of tips.Oct 23, 2026
Navigate360 acknowledged the breach (Reuters), and the California Attorney General's breach list shows Navigate 360, LLC with a reported date of Oct 23, 2026.Oct 27, 2026
The Privacy Commissioner of Canada announced an investigation into Navigate360's security safeguards.
- Navigate360 notice
- Data copied from one of its systems between November 21, 2025 and March 5, 2026; names, addresses, dates of birth, Social Security numbers, phone numbers, email addresses and other details may be involved, varying by person. No evidence of misuse for fraud or identity theft, the company says. It reported the incident to law enforcement and notified regulators.
- Toronto Crime Stoppers
- Says the data contained 176,859 Toronto tips and 14,973 names, and that Navigate360 could not say whether the names belong to tipsters, suspects or both. Says it has asked repeatedly for the text of the tips without getting it.
- Privacy Commissioner of Canada
- Investigating Navigate360, the provider of the tip platform, under federal private-sector privacy law. The Commissioner's office also said that law generally does not apply to not-for-profit organizations, and Crime Stoppers is one.
- California Attorney General
- The breach list shows Navigate 360, LLC: date of breach November 21, 2025, reported October 23, 2026. The listing does not show the number affected or the data types.
What is known and not known
As of October 30, 2026. This table is updated when the organisations publish more.
| Item | What has been said | Status |
|---|---|---|
| Access and copying of data | Between Nov 21, 2025 and Mar 5, 2026 (Navigate360) | Confirmed (Navigate360) |
| Personal data types | Names, addresses, dates of birth, Social Security numbers, phone numbers, email addresses, other | Possible (Navigate360), varies by person |
| Tips from Toronto | 176,859 tips, Jan 2022 to Nov 2025 | Reported (Toronto Crime Stoppers, which says Navigate360 told it) |
| Names inside tips | 14,973 names; role not stated | Under investigation |
| Text of the affected tips | Not provided to Toronto Crime Stoppers | Not stated |
| Whether Navigate360's notice covers P3 and Crime Stoppers | The notice does not name them | Not stated |
| Total across Canada and the US | News reports cite different figures; no official total found | Under investigation |
| Misuse of the data | Navigate360 says no evidence of fraud or identity theft | No misuse found (Navigate360) |
| Cause of the intrusion | Not described in the notice | Not stated |
| Credit monitoring offer | The notice page does not mention one | Not stated |
What this kind of leak can lead to
Tips are different from ordinary customer data. A tip's text may describe an event, a person and a place, and if it also carries a contact detail or a distinctive fact, it can point to the sender or to the person named. Generally, a combination of name, address, date of birth and Social Security number is what identity thieves use to open accounts, which is why a credit freeze matters for notice recipients. For tipsters, the more likely harm is social: someone guessing who reported them. That cannot be fixed by changing a password, so the steps above focus on caution with contact details and on official channels.
Tipster: contact detail or distinctive fact in the tip
↓→
Someone could guess who reported
Use police or a lawyer if at risk; be careful with messages about the tip
Person named in a tip
↓→
Unverified claims about a tip may circulate
Do not reply; keep a record; report threats to police
US notice recipient: name, address, birth date, SSN possible
↓→
Account-opening fraud
Credit freeze; check reports and statements
'No evidence of misuse' is not a promise
Navigate360 says it has no evidence that personal information has been misused. That describes what the company has found so far. Because tips can stay sensitive for years, keep the precautions in place even if nothing happens soon.
For organisations that run tip lines and reporting channels
Nothing in the published statements explains how the intrusion happened, so this section sticks to points that follow from what was disclosed.
Ask your platform vendor, in writing, what it holds about your reporters
According to Toronto Crime Stoppers, what Navigate360 told it changed between March and June, and it still lacks the text of the tips. Decide before an incident what the vendor must hand over, how fast, and in what form, and put it in the contract.
Collect less, and strip identifying details before storage
An anonymous channel should not store phone numbers, email addresses or free-text details it does not need. Crime Stoppers says it removes identifying details before passing tips to police, but Toronto Crime Stoppers reports that names were present in the affected data (14,973). Submit a dummy tip and check every stored copy to see what your system keeps.
Plan a pause and a clear message for reporters
Toronto Crime Stoppers stopped taking tips and told people not to use its phone, web and app routes. Decide in advance who can order a pause, what you tell reporters, and what alternative channel you point them to.
Sources (public record)
The facts above come from the public sources below. The statement on torontocrimestoppers.ca could not be retrieved, so Toronto's figures are attributed to Toronto Crime Stoppers as reported by two news outlets.
- Navigate360, Notice of Data Breach — navigate360.com
- Office of the Privacy Commissioner of Canada, news release of October 27, 2026 — priv.gc.ca
- California Attorney General, data breach list (Navigate 360, LLC, reported date) — oag.ca.gov; entry page — oag.ca.gov
- National Capital Area Crime Stoppers notice — crimestoppers.ca
- Toronto Crime Stoppers statement of October 22, 2026, as reported by The Record — therecord.media and CP24 — cp24.com
- Reuters on Navigate360's October 23 acknowledgement — insurancejournal.com
Update history
2026-10-30: First version, based on the sources above. Counts from different jurisdictions and outlets are not added together; larger figures reported in the news for Canada and the US have no official source yet and are not used.
Read next
- Scams that follow a leak: What is phishing? / How to check if your password was leaked
- Protect your accounts: Multi-factor authentication guide / Choosing a password manager
- Other incidents in 2026: list of breaches and cyberattacks (Japan and worldwide)