# Navigate360 / P3 Global Intel breach by Internet Yiff Machine exposes anonymous Crime Stoppers tips; Toronto Crime Stoppers suspends operations

> The hacktivist collective Internet Yiff Machine claimed a breach of P3 Global Intel, the tip-management platform owned by Navigate360, and leaked the data in March 2026 (about 8.3 million records overall; about 1.5 million Canadian Crime Stoppers tips, roughly half containing personal information). After a CBC investigation, Toronto Crime Stoppers froze operations and told the public to stop sending tips.

- **Published:** 2026-10-22T21:09:29Z
- **Last reviewed:** 2026-10-22T21:09:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4183
- **ID:** TL-2026-4183
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** Internet Yiff Machine
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

P3 Global Intel is a Texas-based, cloud-based tip and intelligence-management platform owned by Navigate360. It is used by Crime Stoppers programs, law enforcement agencies, schools and nonprofits, and parts of the U.S. federal government. On or before 2026-03-18, a hacker persona calling itself 'The Internet Yiff Machine' supplied Straight Arrow News (SAN) and the nonprofit archive Distributed Denial of Secrets (DDoSecrets) with a cache of more than 8.3 million records (about 93 GB claimed) reportedly taken from P3. The data is reported to span February 1987 to November 2025. Reported contents include crime tips, chat logs between tipsters and recipients, names, email addresses, dates of birth, phone numbers, home addresses, license plate numbers, Social Security numbers, criminal histories, user account details, customer support requests, law-enforcement bulletins, and unencrypted account IDs and passwords stored in plain text. Despite marketing promises that tipsters 'will remain anonymous at all times', personal details of some tipsters appear in the data, and Malwarebytes noted that P3 captures session information from web/mobile submissions that could help identify tipsters.

Access method is only partially documented and rests on the actor's own claims: the hacker alleged initial access via social engineering of a customer account, followed by exploitation of a software vulnerability to extract data. No CVE has been published. The stated motivation varies by outlet: proving that Navigate360 and P3 lied about their security capabilities, and ideological opposition to law enforcement. CP24 reported the data was also allegedly offered for sale on the dark web for $10,000.

Vendor and customer response has been slow and contested. Navigate360 CEO JP Guilbault said the company had not confirmed that sensitive information was accessed or misused and engaged a third-party forensics firm, and later declined interviews citing an ongoing criminal investigation. Portland Police Bureau told residents to temporarily refrain from using Crime Stoppers. Toronto Police were notified on 2026-03-18, Calgary Police in April and Vancouver Police in May. The Canadian Crime Stoppers Association said it was aware of a security incident but unaware of specific impact on Canadian programs. According to The Record, Navigate360 repeated through April that P3 was secure, denied in April that Toronto data was affected, confirmed data exposure in June without detail, and did not respond to legal requests for the stolen tip texts. After a CBC investigation in October 2026, Toronto Crime Stoppers froze operations, directed Navigate360 to stop accepting tips, halted processing through Canada's National Anonymous Call Centre, and said: 'Until we have a safer way to protect you, please do not send us tips by phone, online, or through the app.' In Toronto, 176,859 tips (January 2022 to November 2025) were affected and 14,973 names were found in them.

Defender relevance: this is a third-party/SaaS vendor compromise (trusted-relationship exposure) of data held under an anonymity promise. It carries physical-safety risk for tipsters and for individuals named in tips. No malware, C2 infrastructure or network IOCs have been published. The IOC list therefore records the actor handle, victim entities, vendor and data-release channels rather than technical indicators. No sources reviewed document the actual exploited vulnerability, the compromised customer account, or the exfiltration channel.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1552 Unsecured Credentials
- T1213 Data from Information Repositories

## Sources

- [Toronto crime tips org freezes operations after details of data breach come to light](https://therecord.media/toronto-crime-tips-org-freezes-ops-after-breach)
- [Millions of 'anonymous' crime tips exposed in massive Crime Stoppers hack: Exclusive (Straight Arrow News)](https://san.com/cc/millions-of-anonymous-crime-tips-exposed-in-massive-crime-stoppers-hack-exclusive)
- [Hackers claim to have accessed data tied to millions of crime tipsters (Malwarebytes)](https://www.malwarebytes.com/blog/news/2026/03/hackers-claim-to-have-accessed-data-tied-to-millions-of-crime-tipsters)
- [Crime Stoppers cyber breach may put tipsters' lives at risk (CP24)](https://www.cp24.com/news/canada/2026/06/18/crime-stoppers-cyber-breach-may-put-tipsters-lives-at-risk/)
- [Hacker claims breach of police tip system used nationwide (Honolulu Star-Advertiser)](https://www.staradvertiser.com/2026/03/18/breaking-news/hacker-claims-breach-of-police-tip-system-used-nationwide/)
- [Portland police urge residents to avoid Crime Stoppers following hack (Straight Arrow News)](https://san.com/cc/portland-police-urge-residents-to-avoid-crime-stoppers-following-hack/)
- [Alleged tip line mega hack puts police hotlines on blast (Hoodline)](https://hoodline.com/2026/03/alleged-tip-line-mega-hack-puts-police-hotlines-on-blast/)
- [Crime Stoppers data breach investigation (CPM Legal)](https://www.cpmlegal.com/cases/investigations/crimestoppers-data-breach-investigation)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4183