Ontario police reconsider Crime Stoppers reporting after platform breach

Ontario police services have reconsidered how they direct the public to Crime Stoppers after a cybersecurity incident involving the third-party platform used to manage tips. The federal privacy commissioner has opened an investigation into the platform provider’s safeguards.

The developments put a spotlight on a practical question for security teams: how can an organization maintain trusted reporting channels when a service it relies on is affected by an incident?

Federal investigation focuses on the platform provider

On October 27, the Office of the Privacy Commissioner of Canada said it had opened an investigation into Navigate360, the company that provides and manages the tip-management platform used by Canadian Crime Stoppers chapters. The investigation will examine the safeguards in place at the time of the breach and the company’s compliance with federal private-sector privacy law.

The commissioner said the office had contacted Crime Stoppers and Navigate360 about containment, risk reduction and prevention. It did not provide further details because the investigation was active. An investigation is not a finding that the company violated the law.

Ontario responses differ by community

Waterloo Regional Police said on October 22 that it had learned in late June about the incident involving Navigate360’s P3 platform and had subsequently received confirmation that Waterloo Regional Crime Stoppers was affected. The service said it stopped promoting Crime Stoppers through its public channels in early July as a precaution.

The service said the local Crime Stoppers organization operates independently and that the Navigate360 platform is not connected to Waterloo police information technology systems. That distinction matters: an incident involving a third-party service does not by itself establish that a police service’s own systems were breached.

On October 29, Treaty Three Police Service announced a temporary pause in promoting Crime Stoppers while it assessed further information. It said it would suspend promotional activities and remove recently installed signs in participating communities.

Reporting options and anonymity

People considering reporting information should check the current guidance from their local police service and Crime Stoppers organization. Waterloo Regional Police and Treaty Three Police both cautioned that reporting directly to police does not provide the same anonymity associated with Crime Stoppers. Both services advise calling 911 in an emergency.

What security operators can take from the incident

For organizations that use outside providers for incident reports or confidential tips, the case is a reminder to identify which vendor holds sensitive information, review the provider’s safeguards and incident-notification arrangements, and decide in advance how reporting can continue if a service is interrupted. These are practical questions for operators to assess; the privacy commissioner’s investigation has not yet established its findings.

SecurityNews has also examined the broader challenge of protecting Canadian critical infrastructure, where operational and information-security risks often intersect.

Sources

• Office of the Privacy Commissioner of Canada: investigation announcement (October 27, 2026)
• Waterloo Regional Police: statement on the incident (October 22, 2026)
• Treaty Three Police: temporary pause in promotion (October 29, 2026)