Toronto Crime Stoppers protected edited tips. Hackers stole the originals.

Toronto Crime Stoppers removed potentially identifying details from tips before passing them to investigators. But some unedited originals remained on the tip-management platform—and hackers stole them. Protecting the version police received did not protect everything people had entrusted to the service. ³

That gap has now closed an anonymous reporting route. Toronto Crime Stoppers announced an immediate pause on October 21, 2026, telling the public not to submit information by phone, online or through its app. For people who already supplied information, the problem is different: the organization still cannot reliably assess whose identity the stolen records reveal. ^{4 3}

Chair Sean Sportun’s instruction was direct: “Until we have a safer way to protect you, please do not send us tips by phone, online or through the app.” Toronto Crime Stoppers removed its website’s “Tip Submit” feature, told platform provider Navigate360 to suspend Toronto’s intake and asked the National Anonymous Call Centre to stop processing new information intended for Toronto. Those steps establish the announced suspension, not separate shutdown times for each channel. ^{3 4}

The figures require care. Toronto Crime Stoppers’ estimate of 176,859 affected tips counts submissions, not people. Its estimate that 12,392 may contain personal information does not establish that each identifies the person who submitted it. Neither figure is an independently audited count of exposed informants. ³

The separate list of 14,973 names, supplied by Navigate360 in September and October, does not resolve that uncertainty. Sportun said it did not explain whose names they were. A name in a crime report could belong to someone being described, rather than the person reporting it. The name count and the potentially personal tips measure different things; they cannot be added together. Earlier references to nearly 177,000 tips and 15,000 names were rounded accounts of these totals, not additional groups. ^{3 2}

The missing material is the text surrounding those names. “Despite numerous requests through our legal counsel, Navigate360 has not provided us with the text of the stolen tips, so we cannot see what each one says,” Sportun said in the account published by Global News on October 22. Without it, Toronto cannot reliably connect names to submissions or judge what a particular record reveals about someone. ³

Nor does anonymity depend only on leaving a name blank. “We never ask for your name, and we don’t want it. But people sometimes include details to explain what they saw,” Sportun said. He explained that staff remove those details before forwarding tips to investigators, but that some original submissions containing potentially identifying information were stolen from P3, Navigate360’s tip-management software. Toronto has used it since 2018. ¹

The failure, then, was not simply that people volunteered information the program did not request. The service retained original material that its own practice recognized needed editing before investigators saw it. The promise of anonymity depended on the security of those originals, too.

That acknowledgment is significant, but it is not a quantified finding about identified tipsters. The available evidence establishes theft of tips and the presence of names in the breach. It does not establish a verified number of exposed informants, a complete inventory of Toronto data fields or that a particular tipster has suffered retaliation or other harm. ^{3 4}

Toronto Crime Stoppers’ account describes months of changing information. Sportun said the data was stolen in March. Reuters had publicly reported the compromise claim by March 18, 2026, establishing that public reporting existed by then—not the exact theft date or necessarily the first disclosure. ^{1 27}

According to Toronto’s account of vendor communications, Navigate360 initially said in March that it had not confirmed an incident and that P3 remained operational. A March 25 communication acknowledged access to P3. Toronto reset passwords and activated multifactor authentication; those were Toronto’s protective actions, not proof that Navigate360 had completed remediation. ⁶

The crucial reassurance came in April, when Toronto says it was told some Canadian data had been stolen but its own submissions were unaffected. In June, that position changed: Toronto was told submissions from January 2022 through November 2025 were affected. In July came the estimates of 176,859 tips and 12,392 potentially containing personal information. The submission dates describe the age of the stolen records, not an intrusion lasting almost four years. ¹

The wider Canadian picture reaches further back. CBC’s investigation, published October 21 at 4 a.m. EDT, reported more than 1.5 million tips sent to Canadian Crime Stoppers chapters caught in the breach, with at least half containing personal information. Its accompanying video described submissions spanning the past 25 years. That is a historical record window, not the duration of the intrusion. ^{13 17}

CBC’s national findings and Toronto’s estimates concern different scopes and evidence sets. The national reporting does not separate personal information about informants from information about people described in tips. Toronto also said the wider, anonymously sourced information had not been shared directly with it. The national total is not a replacement for Toronto’s estimate, and the two personal-information measures cannot be treated as directly comparable rates. ^{13 1}

Navigate360’s public position developed as well. An October 23 report carried by CNA, updated October 24, described the company acknowledging that hackers entered one of its systems and copied months’ worth of data. That acknowledgment does not establish that Toronto received the stolen tip text, explain the roles of the people named or demonstrate completed security repairs. No specific delivery or resumption date has been verified. ²²

Toronto police separately suspended their use of Crime Stoppers while assessing safeguards. The distinction matters: Toronto Crime Stoppers and Toronto Police Service are separate organizations, and the breached platform operates independently of the police service. Theft from that platform is not evidence that Toronto police’s internal computer systems were breached. ^{5 3}

The pauses spread across Ontario. Halton, Peel and Hamilton announced suspensions or pauses on October 22. Halton said some information related to its region was included; Peel said it would not resume participation until satisfied the platform was secure. Hamilton was seeking more information about security and safeguards before resuming. ^{32 44 62}

York also suspended its partnership immediately on October 22 while reviewing the impact on operations and tipster safety. Kingston’s October 23 statement said it was not using Crime Stoppers as a reporting channel while assessing developments. They were not merely considering whether to stop: assessment and suspension were happening together. London also announced a suspension on October 23. These are local decisions, not evidence of a Canada-wide shutdown. ^{54 56 61}

Direct police reporting remains available, but it is not an equivalent replacement. Hamilton lists 905-546-4925 for non-emergency reports. Kingston directs callers to 613-549-4660, extension 0. York lists 1-866-876-5423 for non-emergencies and also accepts messages and email, explicitly warning that keeping someone’s identity private does not guarantee anonymity. For an immediate emergency, call 911. ^{62 56 54}

As of October 24, no dated Toronto reopening announcement had been verified; the latest dated accounts continued to describe the pause. Restoring the service requires more than switching a submission form back on. People who already submitted tips need a meaningful assessment of what the stolen material reveals. People with new information need safeguards strong enough to justify the promise that brought them to Crime Stoppers in the first place. ^{3 1}