Canada’s Privacy Watchdog Opens Probe Into Crime Stoppers Tip Breach

Canada’s privacy watchdog is opening a probe into a cybersecurity incident that hit tip records held for Crime Stoppers programs across the country, the latest reminder that the apps and platforms Canadians use on their phones can expose sensitive personal information when a vendor gets breached. The pattern will sound familiar to readers who followed recent Telus account access issues and other Canadian data incidents this year.

Privacy Commissioner of Canada Philippe Dufresne has started an investigation into Navigate360, the commercial company that provides and manages the tip management platform used by Canadian Crime Stoppers chapters, the Office of the Privacy Commissioner of Canada said in a release on Tuesday.

The office said the probe will look at the security safeguards Navigate360 had in place when the breach happened, and whether those measures met Canada’s federal private-sector privacy law. After learning of the incident, the office contacted both Crime Stoppers and Navigate360, focusing on containing the breach, reducing risks for people who may be affected, and preventing another one.

A CBC News investigation reported last week that more than 1.5 million Canadian tips submitted over about 25 years were compromised when Navigate360 was hacked in March. According to that reporting, more than 850,000 of those records included personally identifiable information, and Navigate360 publicly confirmed the breach only on Friday, months after it occurred.

That matters for iPhone and Android users because tip lines are no longer just a phone number on a fridge magnet. Many Crime Stoppers tips now move through websites and mobile tools run by third-party vendors, so people who thought they were leaving an anonymous tip may still have names, contact details or other identifiers sitting on a commercial server.

Federal private-sector privacy rules generally cover organizations that collect personal information in the course of commercial activities. Crime Stoppers itself is a not-for-profit, and the office noted that the law generally does not apply to not-for-profits. The investigation is aimed at Navigate360 as the commercial platform provider. The office said it cannot share more details while the matter is active.

Canadians have already seen how loyalty apps and retail accounts can spill personal details when systems are hit, from the More Rewards notice this month to the earlier Loblaw network breach that forced customer logouts. The Crime Stoppers case raises a sharper worry: tip data can identify people who reported crime, not just shoppers chasing points.

If you have ever submitted a Crime Stoppers tip online or through an app, watch for unexpected emails, texts or calls that reference an old tip, ask you to “confirm” personal details, or push you to open a link. Treat those as potential phishing attempts until you can verify them through a contact method you already trust. The office has not published a list of affected tipsters, and the number of Canadian records exposed is still unclear.

Would you still submit a Crime Stoppers tip through a phone app knowing a third-party vendor holds the record?