When Andrew Rivard spotted a Crime Stoppers ad offering a $2,000 reward for tips in the winter of 2025, he decided to report what he knew about illegal cigarette sales in his neighbourhood.
Rivard’s original tip shows he disclosed his full name. He says he trusted the organization’s long-standing promise to protect the identities of all tipsters.
“I was told nothing would come of it; no one would come to me with, you know, I guess, resentment,” Rivard said. “I just was hoping it would be that exactly — anonymous.”
But the Manitoba man’s report — along with information from more than 1.5 million other tips submitted to Canadian Crime Stoppers programs over the last 25 years — was exposed in a massive data breach, an exclusive CBC investigation has found.
The personal information captured in some compromised tips was detailed enough for CBC to contact more than a dozen tipsters — including Rivard — who reacted with shock and fear for their safety.
“It’s very scary, to be honest,” said Rivard, who now worries his home address and phone number may be used by criminals for retaliation.
Rivard’s original tip as it appeared in the leaked data, including his full name. CBC retroactively redacted other personally identifiable information. (Valérie Ouellet/CBC)
The data was stolen last March by hacktivist collective Internet Yiff Machine. In a manifesto, the group said it wanted to disprove the claim by P3 Global Intel — the company hired by Crime Stoppers to manage its tips — that the platform was “anonymous” and “secure.”
A copy of the hacked data was made available to researchers and journalists, including CBC, by Distributed Denial of Secrets, a U.S. non-profit that archives and publishes hacked and leaked documents it deems to be in the public interest.
CBC took extensive precautions to protect this sensitive data throughout its investigation. Our security measures included, but were not limited to, encryption and working in a self-contained, offline environment. The sensitive information was only accessible to a small number of CBC journalists working on the project. Ultimately, CBC intends to destroy its copy of the dataset.
Beyond confirming they were hacked over six months ago, the Canadian Crime Stoppers Association (CCSA) and individual chapters have not spoken about the extent of the breach, only saying they await a detailed report from Navigate360, the company that owns the P3 platform.
This is the first time precise figures on how many Canadian tipsters were compromised in the breach — and the severity of the information exposed — have been made public.
Canadian investigation launched into data breach that exposed millions of IDs
Hacker took 100,000 documents in 2025 ‘cyber incident,’ Kingston Police say
Our interviews and analysis of Canadian content in the leaked data suggest that Crime Stoppers, along with the company it contracted to manage its database, failed to protect tipsters’ identities, left personal information unredacted and improperly retained decades of sensitive records.
“For a system that has been designed to promise anonymity to the users, that has failed categorically,” said Prof. Ali Dehghantanha, the Canada Research Chair in Cybersecurity and Threat Intelligence at the University of Guelph.
He’s one of two experts who were shown our methodology and limited samples of the data from a secure CBC laptop.
After seeing CBC’s main findings, the RCMP shared concerns that the breach could “jeopardize public safety, including the safety of tipsters, individuals identified in tips and police officers,” it said in a statement, adding it was originally told the leak did not include Canadian data or personal information.
CBC also shared the same information with the CCSA, which declined an interview.
In a written statement, the organization’s president, David J. Forster, said they “recognize the concern and uncertainty this incident has created, particularly for people who trust Crime Stoppers with sensitive information.”
There are currently 68 Crime Stoppers chapters registered as non-profits in Canada, according to data from the Canada Revenue Agency.
Professor Ali Dehghantanha is one of two cybersecurity experts who examined samples of the data. (Li Yanjun/CBC)
Crime Stoppers is a network of civilian-run non-profits that collects anonymous tips on crime and suspicious activity. It operates independently of law enforcement, though it refers a portion of tips back to them to assist in investigations.
The organization often appeals to the public, in partnership with police, for help with unsolved crimes and to advance investigations — all with the promise of anonymity for tipsters who contact them.
CBC’s analysis of Canadian tips found mentions of many high-profile cases that generated significant public attention — from Barry and Honey Sherman’s murders to Amber Tuccaro’s disappearance, Montreal’s Luka Magnotta case and, more recently, the international manhunt for Ryan Wedding.
Many of the tips dealt with serious allegations, with some people explicitly saying they feared retribution for speaking out.
Citizens called with information about alleged murderers, terrorists and pedophiles or incriminating details about people they were close to, like family members on the run or breaching court orders.
In 2012, police asked for the public’s help in identifying the voice of a man with a connection to missing Indigenous woman Amber Tuccaro. CBC found hundreds of tips mentioning her disappearance in the leaked Crime Stoppers tips. (Valérie Ouellet/CBC)
A third of all tips talked about drugs and drug trafficking; hundreds reported suspicious activity in their neighbourhoods, often naming individuals and implicating organized crime, biker gangs or drug cartels — including the Hells Angels, Rock Machine and Outlaws, as well as B.C.’s Red Scorpions and Independent Soldiers.
‘Surrey Six’ murders mastermind Jamie Bacon released from prison
Notes in the data from Crime Stoppers staff suggest some of those tips led to real-life consequences: Nearly 49,000 tips were linked to a case cleared by an arrest or criminal charges, while nearly 1,000 tipsters were approved for cash rewards.
“I am concerned. I am really worried,” said Dehghantanha, who has conducted digital forensics investigations for over a decade.
“I am really concerned about these records … being in the hands of the wrong people, while those people who have been impacted are not aware of that and do not have any support.”
Over a million Canadian tips leaked from Crime Stoppers database
That’s exactly the situation one Canadian woman is facing. CBC agreed to withhold her identity given her safety concerns.
She gave a tip about the murder of a loved one, which was unsolved at the time.
“I just feel all the anxiety and scared feeling come back,” said the woman. Police have now charged an individual with murder.
“They were capable of hurting my loved one. They could come back and hurt one of us.”
More than 850,000 tips — about half of all Canadian records identified by CBC — included personally identifiable information about tipsters, individuals named in allegations and even Crime Stoppers staff and police.
Street addresses and phone numbers appeared most frequently, alongside tens of thousands of personal emails, licence plates and hundreds of banking details related to cash rewards — information that could all be used to uncover an individual’s identity.
We could not determine in every instance whether the information belonged to a tipster, a victim or those accused of a crime.
However, CBC found that in over 4,300 reports, tipsters introduced themselves with a full name, although Crime Stoppers explicitly tells the public to avoid including identifying details. Still, this represented a fraction of reports, at less than one per cent of all entries over 25 years. CBC wasn’t able to verify whether all names were legitimate.
In 2021, police sought the public’s help in identifying a suspect caught on video near the home of billionaire philanthropists Barry and Honey Sherman. (Evan Mitsui/CBC)
Despite hundreds of those tips containing clear staff warnings that a tipster had “self-identified” or had been “exposed,” the information still appeared in the database unredacted.
Storing all these data points together is a gold mine for fraudsters, said Dehghantanha.
“Imagine I am calling you and talking about the tip that you have provided and asking for more information. Immediately, I build … trust,” he said.
Shock and surprise after FBI arrests Canadian cybersecurity expert in ShinyHunters hacking case
A name or phone number on a list might not seem like much, but it’s enough to do serious damage, said Ben Coon, chief intelligence officer of U.S. cybersecurity firm Unit 221B, who was also shown limited samples of the data.
“From what I saw, there’s so much low-hanging fruit here that we could ask questions,” said Coon, who said the data could be used for crimes ranging from financial fraud and extortion to money laundering.
Beyond what was collected, experts say the decision to store decades of historical tips in a single place defies basic data retention standards.
“If a tip is closed, does that need to stay online?” said Coon. “The answer to that, to me, is no.”
Both experts agree that even though Crime Stoppers uses a third party to manage its data, it is still responsible for auditing how well it is secured.
“You can always outsource the operation … [and] the work,” said Dehghantanha. “But you cannot outsource the accountability. You are always accountable when you are collecting the data.”
Both cybersecurity experts said they were surprised CBC had found the data as they couldn’t locate copies of it online, which they said was reassuring. But they added that once a dataset has been leaked, it’s generally available somewhere.
In an email exchange with CBC News in September, someone purporting to represent Internet Yiff Machine wrote, “I briefly attempted to sell it publicly; however, changed my mind and no copy has made it into the public yet.”
They added that the security measures of P3, which was storing Crime Stoppers’ tips, were “terrible” and that the platform is still vulnerable.
“I wouldn’t trust [the hackers] at all,” said Dehghantanha. “Selling [data] on the underground market is not that difficult, right…. There is a demand.”
Internet Yiff Machine’s manifesto includes lines critical of police departments and for-profit prisons. (Valérie Ouellet/CBC)
In a statement, the Canadian Crime Stoppers Association said, “If there is information within the leaked records that could identify people who submitted tips, it is an extremely serious issue.” It added that protecting people’s safety and anonymity is its “highest priority.”
It did not directly comment on the precise figures shared by CBC, but said that it has been communicating with the third-party platform “to assess what records may have been affected, what personal information may have been exposed and what measures were taken to enhance the security of the platform.”
“With regard to notifying individuals identified in the records, CCSA has concerns about doing so without jeopardizing the anonymity and safety of tipsters,” it said, adding that “the information available to us does not distinguish people who submitted tips from people identified in them.”
“We will share further verified information as it becomes available, while ensuring that our communications do not create additional risks for individuals.”
Navigate360, the U.S.-based company that owns the P3 platform, did not respond to CBC’s requests for comment, which included questions about what security measures it had taken since the hack, whether it had shared reports with Crime Stoppers about the compromised data and whether it was still collecting tips.
ShinyHunters hackers say they breached FBI, stole employee data
RCMP warn of new scam involving the purchase of gold
The RCMP told CBC that at the time of the leak, it was “advised that Canadian data had not been affected based on the results of the preliminary personally identifiable information (PII) assessment.”
“Then, in May 2026, the RCMP was informed by Crime Stoppers that the data breach did include Canadian data but would not contain PII of persons who have reported.”
The national police service added that it is now “engaged with the Canadian Crime Stoppers Association to determine the full scope of the incident.”
It stated that it has not received reports of anyone being threatened as a result of the breach and advised anyone with concerns about their submitted information to contact the organization or their local chapter.
The Toronto Police Service, which uses tips from Toronto Crime Stoppers — the chapter with the most tips in the leak — told CBC that the group had notified it of a hack in March, but that it “has not received any information indicating the safety of officers, tipsters or members of the public has been compromised.”
As for Rivard, the Manitoba man whose tip was exposed in the leak, he says Crime Stoppers should have been more transparent.
“It might have been embarrassing, but own up to it, just tell the public, let them know, and they might have your trust after, they might not: Let them decide.”
Methodology: How CBC identified Canadian tips in the Crime Stoppers hack
This investigation is based on CBC’s analysis of more than 8.3 million raw records leaked in March 2026. The breached data originated from P3 Global Intel, a U.S.-based tip management software owned by the company Navigate360. A copy of this hacked data was released to journalists, including CBC, by Distributed Denial of Secrets, a non-profit whistleblower site that publishes hacked documents it deems to be in the public interest. The data contains unverified criminal allegations that have not necessarily been investigated by police or proven in court.
CBC took extensive precautions to protect this sensitive data throughout its investigation. Our security measures included, but were not limited to, encryption and working in a self-contained, offline environment. The sensitive information was only accessible to a small number of CBC journalists working on the project. Ultimately, CBC intends to destroy its copy of the dataset.
CBC considered a tip to be Canadian if it was submitted to a Canadian Crime Stoppers chapter or contained specific Canadian geographic and linguistic references.
We identified a grand total of 1.6 million records using these combined methodologies. The vast majority were tips submitted directly to Canadian Crime Stoppers chapters (97.98%). The remaining 32,000 tips (2.02%) were submitted to U.S. and international Crime Stoppers chapters, but they all contained Canadian references, such as city names, postal codes, phone area codes or the names of government institutions.
The data was compared against a list compiled by our team of over 700 crime-related keywords, including the names of victims, suspects, missing persons and high-profile police operations.
For this analysis, CBC defined personal identifying information (PII) as: a tipster’s full name, any complete street address, postal code, direct phone number, personal email, vehicle licence plate, personal social media account and/or banking details. Publicly advertised phone numbers of Crime Stoppers chapters and police departments, as well as general switchboards, tiplines, hotlines, general emails and the physical addresses of chapters and police departments were excluded from our PII analysis.
We used Google’s Gemini AI to help us draft, troubleshoot and optimize computer programming scripts in Python and SQLite to structure and systemically analyze a dataset too massive to process manually, (e.g. with spreadsheets). Every suggestion, piece of logic, and code generated by Gemini was independently reviewed by our data journalist to ensure integrity and adherence to CBC’s Journalistic Standards and Practices. All data outputs were rigorously audited in the same way. The interface was strictly used to generate computer code and was not permitted to make autonomous decisions, run the code itself or access the source database at any time.
CBC/Radio-Canada’s corporate agreement with Gemini stipulates that our data is kept strictly private. None of our prompts, uploaded files or chats can be used to improve Google’s AI models, and no human reviewers can access our conversations.
Methodology, coding and data analysis by Valérie Ouellet
Data analysis and additional research by Michelle Allan
