VULNpocalypse
HighBreach / campaignOngoing

Crime Stoppers tips exposed in P3 Global Intel breach, Toronto pauses intake

A March breach at tip platform P3 Global Intel exposed Crime Stoppers tips; Toronto paused intake, so ignore anyone asking for your tip number.

Published
Updated
Exploitation
Yes, Toronto Crime Stoppers says original tip submissions with potentially identifying information were stolen from P3

What happened

Malwarebytes reports that a breach in March involved P3 Global Intel, a Texas-based tip-management platform owned by Navigate360. Its software is used by Crime Stoppers programs and other organizations in the US and elsewhere (Malwarebytes).

According to Malwarebytes, an October CBC investigation described the Canadian impact:

  • More than 1.5 million tips spanning 25 years were exposed.
  • Over 850,000 of those tips contained personal information.
  • Exposed data included addresses, phone numbers, email addresses and some banking details linked to rewards.
  • The data belonged to tipsters, people named in allegations, and others, including police and Crime Stoppers staff.

(Malwarebytes)

In an October 21 statement, Toronto Crime Stoppers said identifying details are normally removed before tips reach investigators. It said some original submissions containing potentially identifying information were stolen from P3. The chapter acknowledged that its anonymity promise had been broken for some users. It has paused phone, website and app submissions while it looks for a safer system (Malwarebytes).

The full scope of the breach is still unclear. A later DataBreaches.net headline reports that the extent of the Crime Stoppers data breach is unknown, according to the Sault Police chief (DataBreaches.net). The sources do not confirm which other Crime Stoppers programs are affected, how many records outside Canada are involved, or who carried out the breach.

Am I affected?

  • Toronto Crime Stoppers tipsters: You may be affected if your original submission contained identifying information. Malwarebytes reports that the statement did not describe an individual notification process or a way to check whether a particular tip was affected (Malwarebytes).
  • People named in tips, and police or Crime Stoppers staff: Malwarebytes, citing CBC, reports that data about these groups was also exposed.
  • Users of other Crime Stoppers programs or other P3-based tip systems: Whether you are affected is not confirmed.
  • Organizations running tip lines on P3 Global Intel: Exposure of your data is not confirmed in the sources.

Malwarebytes says affected tipsters could face retaliation, intimidation or extortion. It adds that scammers could use details of a genuine tip to make an approach more convincing (Malwarebytes).

What to do now

  1. Treat unsolicited contact as suspect. Toronto Crime Stoppers says it will never contact you first to request a tip number, password or other information. Treat any such approach as possible impersonation (Malwarebytes).
  2. Do not send new tips to Toronto Crime Stoppers. Until it announces a safer system, do not use its phone, online or app channels. The organization’s statement says: “Until we have a safer way to protect you, please do not send us tips by phone, online, or through the app.” (Malwarebytes)
  3. Call 911 in an emergency. Anyone in immediate danger should call 911. During the pause, send non-emergency reports in Toronto directly to Toronto police, knowing those channels are not anonymous (Malwarebytes).
  4. Check your local program. If you use a different Crime Stoppers program, check its official website for updates about its reporting system (Malwarebytes).
  5. If your organization uses P3 Global Intel: The sources give no vendor guidance. We suggest asking the vendor directly whether your tenant’s data was involved. This step is our recommendation, not something reported in the sources.

Sources