Canada's privacy commissioner opened an investigation into Navigate360 after a March hack exposed more than 1.5 million Crime Stoppers tips, over 850,000 containing personal information, with several police services pausing tip intake.
Canada's Privacy Commissioner, Philippe Dufresne, opened an investigation on 27 October into Navigate360, the commercial firm that runs the tip platform used by Canadian Crime Stoppers chapters, after a March hack exposed more than 1.5 million tips submitted over about 25 years. More than 850,000 of the records contained personal information, according to CBC reporting of the breach.
The investigation will examine the security safeguards Navigate360 had in place at the time of the breach against its obligations under federal private-sector privacy law. Navigate360 confirmed the breach only in the previous week, months after the March hack, and several police services have since paused taking tips through the platform, including services in Ontario, Manitoba and Saskatchewan.
One distinction matters for readers: the commissioner's probe targets Navigate360, the commercial vendor, rather than Crime Stoppers itself, which CBC reported watchdogs cannot formally investigate because of its not-for-profit structure. The tips at issue were submitted by members of the public, often anonymously, to report crime, which is why the exposure of personal information in so many records carries particular weight.
The commissioner's announcement, as republished from the official statement, confirms the investigation, its target and its focus on safeguards at the time of the breach. The scale figures, the March timing and the delayed confirmation come from CBC reporting as carried by secondary coverage, which agrees on those points, while the police pauses are corroborated across the same coverage.
A legal expert told CBC the breach was one of the worst breaches in Canadian history, an assessment that reflects both the volume of tips and the sensitivity of a system people used on the understanding that their identities would be protected. Whether the investigation finds that Navigate360's safeguards fell short of the law will determine whether the case ends with findings, recommendations or further action.
The investigation is at its opening stage, with no findings yet published. Its outcome will matter well beyond one vendor, because tip platforms across the country depend on the same promise of anonymity that this breach put in doubt.