In the wake of a data breach exposing decades of Crime Stoppers tips that a legal expert called “one of the worst breaches in Canadian history,” both federal and provincial privacy watchdogs have suggested their hands are tied.
The true scale of the hack was revealed by an exclusive CBC investigation, which found that more than 1.5 million Canadian tips submitted to Crime Stoppers programs across the country over the past 25 years were compromised.
More than 850,000 tips — about half of all Canadian records identified — included personally identifiable information. We could not determine in every instance whether the information belonged to a tipster, a victim or someone accused of a crime.
Hackers stole the data last March from Navigate360, a U.S. third party that Crime Stoppers hired to manage and secure its anonymous tips.
But CBC has learned that neither the Office of the Privacy Commissioner of Canada (OPC) nor the Information and Privacy Commissioner of Ontario (IPC) can formally investigate Crime Stoppers for failing to protect tipsters’ personal information, due to a glaring gap in Canada’s privacy laws.
The federal private-sector privacy law applies to organizations that collect, use, and disclose personal information in the course of commercial activities, the OPC told CBC News in an email — but it “generally does not apply” to not-for-profit organizations like the Canadian Crime Stoppers Association (CCSA) or its local chapters.
Ontario’s privacy watchdog also said it does not have the authority to investigate the breach, as it only oversees public-sector privacy law.
More Canadian Crime Stoppers chapters pause program after CBC investigation | Hanomansing Live
The Ontario privacy commissioner said it had already identified this exception “as a significant gap” in 2021, when it called for the adoption of a provincial private-sector privacy law that would more clearly cover the not-for-profit industry.
“The significant volumes of data held by the not-for-profit sector in Ontario are not immune from privacy and security vulnerabilities, yet they remain largely unprotected by federal privacy law,” reads the 2021 report, which urged the Ontario government to fix the gap immediately. “No regulator has been given responsibility for this sector.”
The issue was first raised in a copy of a CCSA internal memo that CBC News obtained on Thursday.
The June 18 document, signed by CCSA president David J. Forster, urges all chapters to follow a number of guidelines in the wake of the data hack.
Over a million Canadian tips leaked from Crime Stoppers database
He advised all chapters to direct media inquiries to the CCSA, and not to contact privacy watchdogs.
“We currently do not believe that you are required, nor should you contact the privacy commissioner in your region at this time,” instructed Forster, saying his organization has “previously assessed that they [the commissioner] do not have jurisdiction over Crime Stoppers.”
Crime Stoppers had ‘potentially one of the most harmful data breaches’ Canada has seen. What’s next?
More than 1.5 million Canadian Crime Stoppers tips leaked, CBC exclusive finds
CCSA has not responded to CBC’s previous request for comment on the contents of the memo.
The legal gap leaves tipsters whose information was exposed with few options for answers.
Still, a lack of formal privacy oversight might not spare the organization or its local chapters from legal threats, said Claudiu Popa, a certified cybersecurity professional with privacy consulting firm Data Risk Canada.
“The accountability trickles up. Where does it go? It goes to the board of directors,” Popa said. “These directors are individuals; they are volunteers. They are people who essentially are personally and legally liable for the outcome here.”
Crime Stoppers is best known for its public appeals, often partnering with police, for help with unsolved crimes and to advance investigations — all with the promise of anonymity for tipsters who contact them. (Tyson Koschik/CBC)
Popa stressed that the CCSA built its legitimacy on a promise of anonymity that it has now broken.
Regardless of the organization’s non-profit status, its leaders could face lawsuits, he said.
“Here’s an organization that has made certain claims and these claims established its legitimacy. Those claims proved to be false and therefore this organization could be considered to be illegitimate right back to Day 1.”
Ann Cavoukian, who served an unprecedented three terms as Ontario’s privacy commissioner, was stunned to find out that the CCSA had advised its local chapters against contacting privacy watchdogs.
“This is appalling!” Cavoukian wrote in an email to CBC News. “I’m not sure if privacy commissioners have jurisdiction here, but if I was still the privacy commissioner, I would go after these folks regardless! This shouldn’t be happening.”
In a Friday press release, Navigate360 confirmed its systems had been breached between November 2025 and March 2026 — its first public acknowledgment of the hack, seven months after it happened.
Ann Cavoukian, seen in a screengrab from 2024. (CBC)
Cavoukian also called the organization’s apparent failure to de-identify or encrypt its data outrageous, adding that employing a third-party company to manage its information doesn’t make the group any less liable.
“You don’t just flip your hands and say, ‘Well, you know, there’s nothing we could do about it.’ No, you do that at the outset. The walls should go up; the data should get protected.”
As GTA police forces pause Crime Stoppers use in wake of data breach, what does it mean for investigations?
The Office of the Privacy Commissioner of Canada said it “has reached out to Crime Stoppers in order to offer expertise and guidance with regard to responding to [its] privacy breach.”
It has also contacted Navigate360 “to obtain more information and determine next steps” and to “ensure that the organizations are taking the necessary steps” to protect Canadians’ personal information.
The OPC added that it has not received any complaints about the matter.
