More Than 1.5 Million Canadian Crime Stoppers Tips Exposed in Platform Breach

The exposed records included addresses, phone numbers, emails, license plates and some banking details. The data was stolen last March by hacktivist collective Internet Yiff Machine, according to the report. In a manifesto, the group said it wanted to disprove P3 Global Intel's claim that the platform was 'anonymous' and 'secure.' P3 Global Intel was hired by Crime Stoppers to manage its tips.

A copy of the hacked data was made available to researchers and journalists, including CBC, by Distributed Denial of Secrets, a U.S. non-profit that archives and publishes hacked and leaked documents it deems to be in the public interest.

The report found that more than 4,300 Crime Stoppers tipsters identified themselves by their full name, and that hundreds of records contained staff warnings that individuals had 'self-identified' or been 'exposed,' yet their information remained unredacted. The leaked data included sensitive allegations involving murder, terrorism, drug trafficking and organized crime. Nearly 49,000 tips were linked to cases cleared through arrests or criminal charges.

The report says the RCMP was initially told Canadian data was unaffected and was later assured that exposed Canadian records contained no personally identifiable information. That appears to contradict CBC's findings. Affected individuals have not been systematically notified because contacting them could further jeopardize their anonymity.

Cybersecurity experts criticized the retention of decades-old records. 'If a tip is closed, does that need to stay online?' asked cybersecurity expert Ben Coon. 'The answer to that, to me, is no.' Prof. Ali Dehghantanha, the Canada Research Chair in Cybersecurity and Threat Intelligence at the University of Guelph, said: 'For a system that has been designed to promise anonymity to the users, that has failed categorically.'

Editor's Summary The breach exposed more than 1.5 million Canadian Crime Stoppers tips, about 850,000 of them with personal data, and included sensitive allegations. The RCMP's earlier assurances conflict with CBC's findings, while experts criticized retaining closed-case records and the platform's failed anonymity promise.