Threat reportData BreachTL-2026-4183
Navigate360 / P3 Global Intel breach by Internet Yiff Machine exposes anonymous Crime Stoppers tips; Toronto Crime Stoppers suspends operations
Navigate360 / P3 Global Intel breach by Internet Yiff (TL-2026-4183), also tracked as P3 Global Intel breach, is a high-severity data breach, first published 2026-10-22. It is attributed to Internet Yiff Machine with medium confidence, affects Navigate360 P3 Global Intel (P3 Campus / P3 tip and intelligence, maps to 5 MITRE ATT&CK techniques (T1078, T1190, T1199), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 1Internet Yiff Machine
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4183
- Threat ID
- TL-2026-4183
- Also known as
- P3 Global Intel breach, Crime Stoppers data breach, Navigate360 breach
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution
- Internet Yiff Machine
- Attribution confidence
- MEDIUM
- Motivation
- HACKTIVISM
- Target sectors
- police - law enforcement, government administration, education, nonprofit, public-safety
- Target regions
- canada, united states of america
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Navigate360 / P3 Global Intel breach by Internet Yiff
Malware and tooling: Dataleak
How Navigate360 / P3 Global Intel breach by Internet Yiff works
The hacktivist collective Internet Yiff Machine claimed a breach of P3 Global Intel, the tip-management platform owned by Navigate360, and leaked the data in March 2026 (about 8.3 million records overall; about 1.5 million Canadian Crime Stoppers tips, roughly half containing personal information). After a CBC investigation, Toronto Crime Stoppers froze operations and told the public to stop sending tips.
P3 Global Intel is a Texas-based, cloud-based tip and intelligence-management platform owned by Navigate360. It is used by Crime Stoppers programs, law enforcement agencies, schools and nonprofits, and parts of the U.S. federal government. On or before 2026-03-18, a hacker persona calling itself 'The Internet Yiff Machine' supplied Straight Arrow News (SAN) and the nonprofit archive Distributed Denial of Secrets (DDoSecrets) with a cache of more than 8.3 million records (about 93 GB claimed) reportedly taken from P3. The data is reported to span February 1987 to November 2025. Reported contents include crime tips, chat logs between tipsters and recipients, names, email addresses, dates of birth, phone numbers, home addresses, license plate numbers, Social Security numbers, criminal histories, user account details, customer support requests, law-enforcement bulletins, and unencrypted account IDs and passwords stored in plain text. Despite marketing promises that tipsters 'will remain anonymous at all times', personal details of some tipsters appear in the data, and Malwarebytes noted that P3 captures session information from web/mobile submissions that could help identify tipsters.
Access method is only partially documented and rests on the actor's own claims: the hacker alleged initial access via social engineering of a customer account, followed by exploitation of a software vulnerability to extract data. No CVE has been published. The stated motivation varies by outlet: proving that Navigate360 and P3 lied about their security capabilities, and ideological opposition to law enforcement. CP24 reported the data was also allegedly offered for sale on the dark web for $10,000.
Vendor and customer response has been slow and contested. Navigate360 CEO JP Guilbault said the company had not confirmed that sensitive information was accessed or misused and engaged a third-party forensics firm, and later declined interviews citing an ongoing criminal investigation. Portland Police Bureau told residents to temporarily refrain from using Crime Stoppers. Toronto Police were notified on 2026-03-18, Calgary Police in April and Vancouver Police in May. The Canadian Crime Stoppers Association said it was aware of a security incident but unaware of specific impact on Canadian programs. According to The Record, Navigate360 repeated through April that P3 was secure, denied in April that Toronto data was affected, confirmed data exposure in June without detail, and did not respond to legal requests for the stolen tip texts. After a CBC investigation in October 2026, Toronto Crime Stoppers froze operations, directed Navigate360 to stop accepting tips, halted processing through Canada's National Anonymous Call Centre, and said: 'Until we have a safer way to protect you, please do not send us tips by phone, online, or through the app.' In Toronto, 176,859 tips (January 2022 to November 2025) were affected and 14,973 names were found in them.
Defender relevance: this is a third-party/SaaS vendor compromise (trusted-relationship exposure) of data held under an anonymity promise. It carries physical-safety risk for tipsters and for individuals named in tips. No malware, C2 infrastructure or network IOCs have been published. The IOC list therefore records the actor handle, victim entities, vendor and data-release channels rather than technical indicators. No sources reviewed document the actual exploited vulnerability, the compromised customer account, or the exfiltration channel.
MITRE ATT&CK techniques used in TL-2026-4183
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Collection
T1213 Data from Information Repositories
Credential Access
Affected products and versions in Navigate360 / P3 Global Intel breach by Internet Yiff
- Navigate360 — P3 Global Intel (P3 Campus / P3 tip and intelligence management platform)
Vulnerable versions: Cloud service; data from 1987 to November 2025 affected - Crime Stoppers programs (Toronto Crime Stoppers, Canadian Crime Stoppers Association and other chapters) — Anonymous tip lines and apps built on P3
Vulnerable versions: Toronto: 176,859 tips from Jan 2022 to Nov 2025
Remediation for Navigate360 / P3 Global Intel breach by Internet Yiff
Patches
- No CVE or vendor patch has been published; the exploited software vulnerability has not been publicly identified
Immediate actions
- Customers of Navigate360 / P3 Global Intel: suspend or restrict tip intake until the vendor provides forensic findings and confirms containment
- Reset all P3 user account credentials and enforce MFA; assume plain-text passwords in the leaked data are compromised
- Reuse check: force password changes anywhere P3 credentials were reused
- Demand from the vendor the list of affected tips, tipster session data and records tied to your organization, and notify affected individuals as required
- Assess physical-safety risk to tipsters and named individuals and coordinate with law enforcement partners
Workarounds
- Tipsters: avoid including identifying details, strip metadata from uploads, use privacy-focused browsers or VPNs, and consider alternative reporting channels while Crime Stoppers intake is paused
- Individuals who may appear in tips: change passwords, enable 2FA and monitor for identity-theft indicators
Longer-term hardening
- Add contractual security, breach-notification timelines and audit rights to tip-handling and other third-party vendor agreements
- Minimize collection of tipster metadata (session, IP, device) and encrypt tip content and credentials at rest
- Run independent security assessments of anonymous-reporting platforms and verify vendor security claims
- Provide customer-account anti-social-engineering controls such as help-desk verification and MFA reset procedures
Weaknesses (CWE) in Navigate360 / P3 Global Intel breach by Internet Yiff
Timeline of Navigate360 / P3 Global Intel breach by Internet Yiff
- Internet Yiff Machine supplies SAN and DDoSecrets with more than 8.3 million records reportedly taken from P3 Global Intel; SAN and others report the breach and Toronto Police are notified the same day. Navigate360 says it has not confirmed sensitive data was accessed and engages a third-party forensics firm.
- Malwarebytes reports the leak's contents, including plain-text passwords, user account details, support requests and chat logs, and notes P3 captures session information from submissions.
- During April 2026 Navigate360 repeats that P3 is secure and denies Toronto data was affected, per The Record (exact day unspecified; date marks the start of the month). Calgary Police are notified in April.
- Vancouver Police are notified of the incident in May 2026 (exact day unspecified; date marks the start of the month), per CP24.
- In June 2026 Navigate360 confirms data exposure to Toronto Crime Stoppers without disclosing details (exact day unspecified; date marks the start of the month), per The Record. It has not responded to legal requests for the stolen tip texts since March.
- CP24 reports the data was allegedly offered for sale on the dark web for $10,000. The Canadian Crime Stoppers Association says it is unaware of specific impact on Canadian programs and Navigate360 declines interviews citing an ongoing criminal investigation.
- After the CBC investigation, Toronto Crime Stoppers freezes operations, tells the public not to send tips by phone, online or app, directs Navigate360 to stop accepting tips, and halts the National Anonymous Call Centre processing. About 1.5 million Canadian tips are reported exposed, roughly half with personal information; 176,859 Toronto tips and 14,973 names are affected (The Record).
Sources cited for Navigate360 / P3 Global Intel breach by Internet Yiff
- Toronto crime tips org freezes operations after details of data breach come to light
- Millions of 'anonymous' crime tips exposed in massive Crime Stoppers hack: Exclusive (Straight Arrow News)
- Hackers claim to have accessed data tied to millions of crime tipsters (Malwarebytes)
- Crime Stoppers cyber breach may put tipsters' lives at risk (CP24)
- Hacker claims breach of police tip system used nationwide (Honolulu Star-Advertiser)
- Portland police urge residents to avoid Crime Stoppers following hack (Straight Arrow News)
- Alleged tip line mega hack puts police hotlines on blast (Hoodline)
- Crime Stoppers data breach investigation (CPM Legal)
Detection coverage for TL-2026-4183
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4183 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.