Crime Stoppers data breach: 3 lessons for businesses that trust a vendor with data
The Crime Stoppers program rests on a simple promise: you can report a crime without ever being identified. On October 21, Toronto Crime Stoppers paused tip intake, and other programs and police services in Ontario, Manitoba and Saskatchewan have since paused tips or their partnership. The cause: the Crime Stoppers data breach at Navigate360, the U.S. vendor whose P3 platform managed the tips.
Your business doesn’t receive anonymous tips. But it probably entrusts information about its customers and employees to online platforms: CRM, payroll, booking, forms. This case shows three things to check with your own vendors: what they tell you after an incident, how long they keep your data, and what your contract says.
The Crime Stoppers data breach in short
According to CBC, the data was stolen in March by a hacktivist group, “Internet Yiff Machine,” which wanted to show the platform wasn’t as anonymous or secure as advertised. CBC analyzed a copy of the data and found over 1.5 million Canadian tips, spanning 25 years. Navigate360, for its part, says its database was breached between November 2025 and March 2026, and says it has “no evidence of misuse.” So far, the sources reviewed don’t report any confirmed impact in Quebec.
🚩 What CBC found
- Data kept long after investigations ended.
- Everything sat with one vendor, on one platform.
✅ The question for your business
- How many years of history do your vendors keep for you?
- Is what’s no longer needed destroyed or anonymized?
🚩 What CBC found
- About half of the Canadian records CBC analyzed.
- It may belong to the tipster, a victim or an accused person.
✅ The question for your business
- Do your forms’ free-text fields collect more than you intended?
- Who reviews what gets entered?
🚩 What CBC found
- Even though the program asks people not to identify themselves.
- Hundreds of records flagged “self-identified” by staff were still unredacted in the database.
✅ The question for your business
- Is redaction done at the source, or only in a copy?
- Is a record flagged as sensitive actually handled?
Lesson 1: the vendor’s story can change
The statement published by Toronto Crime Stoppers traces seven months of exchanges with its vendor. It shows the same case described in very different ways over time.
Ali Dehghantanha, a cybersecurity expert who reviewed samples of the data for CBC, put it this way: “They apparently received six different [accounts] in seven months from the vendor.” To him, that’s a red flag about the company’s ability to investigate and fix the weakness.
For a small business, the lesson is concrete: “no impact for you” isn’t a conclusion, it’s a step. Log every notice you receive, with its date, and ask again in writing which data, which period and which accounts are affected.
Lesson 2: keeping 25 years of data means keeping 25 years of risk
Toronto redacted identifying details before passing tips to investigators. But the originals stayed in P3. It’s the classic trap: you protect the copy you use, not the one you forget. In Quebec, section 23 of the private-sector act requires destroying or anonymizing personal information once the purposes of its collection are met, and section 5 limits collection to what’s necessary.
Toronto Crime Stoppers also says that, going forward, its partners will have to protect the data, delete what isn’t needed and report any incident immediately. Those are three clauses a small business can ask for today.
Lesson 3: responsibility stays with you
⚖️ Responsibility can’t be outsourced
“[How] Canadian privacy law functions is that the organization that collects the personal information is the one that’s responsible,” Michael Geist, a law professor at the University of Ottawa, told CBC. In Quebec, section 3.1 of the private-sector act says the same: the business is responsible for the personal information it holds, even when a vendor hosts it.
Agreement with a vendor that processes your personal information
What Quebec law asks you to put in writing (s. 18.3) — check your contracts
Protection measures. The contract specifies the measures the vendor must take to protect the information.
↳ Not a general promise: MFA, encryption, logging, who has access.
Use limited to the mandate. The information is used only to carry out the contract.
↳ No analysis or reuse for other clients or other purposes.
No retention after the contract. The vendor doesn’t keep the information once the contract ends.
↳ Ask how destruction is confirmed, including for backups.
Notice without delay. The vendor notifies your person in charge of the protection of personal information without delay of any breach or attempted breach.
↳ Put in writing who gets notified, how, and what the notice must contain.
Right to audit. Your business can carry out any verification relating to confidentiality.
↳ A recent audit report or a yearly security questionnaire is already a start.
If the information is communicated outside Quebec, section 17 also requires a privacy impact assessment and a written agreement.
And if an incident affects your data at a vendor, section 3.5 requires you to take reasonable measures and, if there’s a risk of serious injury, to notify the Commission d’accès à l’information and the people concerned. Your incident register (section 3.8) must keep a record of it.
This week: 5 checks for your vendors
- ☐ List the vendors that host information about your customers or employees (CRM, payroll, booking, web forms).
- ☐ For each one, ask how many years of history they keep, and have what’s no longer needed destroyed or anonymized (s. 23).
- ☐ Check that every account with access to these platforms has multi-factor authentication, including old accounts of employees who left.
- ☐ Reread the contract: are the five clauses above in it? If not, ask for an amendment.
- ☐ Add any alert received from a vendor to your incident register (s. 3.8), even if you’re told there’s “no impact.”
This isn’t the first time a vendor has exposed its clients’ data: we saw it with the health vendor breach in Prince Edward Island and with the payroll data breach. For your web hosts, our questions to ask after the Pantheon incident apply too.
At NeoTech, we help you inventory your vendors, close unneeded access and keep backups under your control. With our cyber monitoring, automated 24/7 monitoring with on-call technician intervention spots unusual sign-ins to your cloud accounts, including those of your outside platforms.
Book your free cyber check
Not sure exactly which vendors hold data about your customers or employees, or what your contracts say? The free cyber check starts with that inventory, then we hand you a clear plan.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- CBC: Toronto Crime Stoppers pauses its program after a data leak (October 21, 2026, updated October 23)
- CBC: the Crime Stoppers data breach: what’s next? (October 23, 2026)
- Toronto Crime Stoppers: statement of October 21, 2026 (PDF)
- CBC Saskatchewan: Crime Stoppers pauses tip intake in Saskatchewan
- CBC Manitoba: Winnipeg police pause their partnership with Crime Stoppers (October 23, 2026)
- LégisQuébec: Act respecting the protection of personal information in the private sector (ss. 3.1, 3.5, 3.8, 17, 18.3 and 23)
Photo: João Jesus, Pexels (Pexels licence).