Privacy Commissioner Investigates Crime Stoppers Data Breach Involving U.S. Vendor Navigate360
Canada's Privacy Commissioner has launched an investigation into a March data breach at third-party vendor Navigate360 that compromised over 1.5 million Crime Stoppers tips submitted over 25 years, including approximately 850,000 containing personally identifiable information.
Privacy Commissioner Philippe Dufresne is opening an investigation into a massive data breach affecting Canadian Crime Stoppers programs. The probe focuses on Navigate360, a U.S.-based third-party company hired by Crime Stoppers chapters worldwide to manage anonymous tips.
More than 1.5 million Canadian tips submitted over the past 25 years were compromised when Navigate360 was hacked last March. Of those records, more than 850,000 included personally identifiable information. Navigate360 confirmed its systems had been breached on Friday, marking its first public acknowledgment seven months after the incident occurred.
The investigation will determine whether Navigate360 complied with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) regarding security safeguards at the time of the breach. While PIPEDA does not apply to not-for-profit organizations like the Canadian Crime Stoppers Association (CCSA) and its local chapters, the law governs how commercial organizations handle personal information.
The Office of the Privacy Commissioner stated it is in touch with the CCSA and has offered expertise and guidance on responding to the privacy breach.