Toronto Crime Stoppers stops taking tips after data breach

Toronto Crime Stoppers has stopped accepting tips after it said 176,859 Toronto tips and 14,973 names were stolen in a March data breach at the company that runs its tip software, and Toronto police have suspended their use of the program.

The organization said the tips stolen were submitted between January 2022 and last November, according to figures provided by the software’s owner, Navigate360, The Canadian Press reported. It said the U.S.-based company has not disclosed whether the names belong to people who submitted tips, people named in them, or both, and has not provided the text of the stolen tips despite repeated requests.

“People in Toronto have come to Toronto Crime Stoppers because we promised they could stay anonymous. This week’s reporting shows that for some of them, that promise was broken. We are deeply sorry,” the organization said in a statement, CBC News reported.

The program has removed the tip submission feature from its website and asked the public not to send tips by phone, online or through its app “until we have a safer way to protect you.” It said it will share details of a new way to take tips in the coming days.

The Toronto Police Service said Wednesday evening it has temporarily suspended its use of Crime Stoppers while it reviews the new information. The force said the breach “raises serious concerns regarding the protection of confidential information provided through the Crime Stoppers program.”

The pause followed a CBC News investigation published Wednesday that found information from more than 1.5 million tips submitted to Canadian Crime Stoppers programs over 25 years was exposed. CBC said Toronto had the most tips in the leak of any Canadian chapter, more than 179,000 by its count, and that more than half of all Canadian tips in the data included personally identifiable information.

Toronto Crime Stoppers said it did not stop taking tips sooner because Navigate360 first said in April that Toronto data had not been taken, and later did not say what information was exposed when it confirmed Toronto data was affected.

“We never ask for your name, and we don’t want it,” the organization said. “But people sometimes include details to explain what they saw. Before a tip goes to investigators, our practice is to remove those details.”

The breach adds to a week of security worries for Canadian institutions. Several federal government websites were taken offline over a PHP security flaw on Wednesday. Policing has also become an issue in the Oct. 26 Toronto mayoral election.

If you find reporting like this useful, consider supporting Canada News Media, an independent Canadian newsroom with no corporate parent.

With files from The Canadian Press and CBC News.