Over 1.5 million Canadian Crime Stoppers tips have leaked: report

A CBC investigation has found that over 1.5 million tips that were submitted to Canadian Crime Stoppers programs over the last 25 years have been leaked.

Per CBC, this was compromised as part of a larger data breach and includes the personal information of some tipsters. Naturally, this led many people to be concerned that criminals who have their data could try to retaliate. (CBC, for its part, says it took “extensive precautions” to in its own handling the sensitive info of tipsters, including encryption and self-contained offline work environments.)

CBC reports that the data was stolen from Crime Stoppers affiliate P3 Global Intel in March by hacktivist group Internet Yiff Machine, which claimed that it wanted to expose vulnerabilities in the company’s platform. U.S. non-profit Distributed Denial of Secrets ultimately made data available to researchers and journalists, including CBC, to study the impact and warn the public accordingly.

According to CBC, more than 850,000 tips included “personally identifiable information” about a variety of people, from tipsters and individuals named in allegations to Crime Stoppers staff and police. Often, this was street addresses and phone numbers, although CBC reports “tens of thousands” of personal emails and licence plates, as well as “hundreds” of banking details tied to cash rewards, were leaked. There were reportedly even over 4,300 cases of tipsters providing full names, despite Crime Stoppers saying not to do that.

Worse still, staff are said to have warned in hundreds of cases that tipsters had been compromised because they either self-identified as such or it was discovered on Crime Stoppers’ end. And yet, the information was still in the agency’s database unredacted.

For context, CBC found that the Canadian Crime Stoppers breach includes tips related to particularly high-profile cases like the mysterious murders of Barry and Honey Sherman, the case of Luka Magnotta, who killed and dismembered Chinese student Jun Lin, and the global manhunt for alleged drug lord Ryan Wedding.

Ultimately, CBC ultimately concluded “that Crime Stoppers, along with the company it contracted to manage its database, failed to protect tipsters’ identities, left personal information unredacted and improperly retained decades of sensitive records.”

CBC says multiple cybersecurity experts it spoke to were surprised that it found the data online, given that they themselves couldn’t. But of course, they acknowledged that such a leak means that this data would almost certainly be available elsewhere, given the way the internet works.

All of this is to say: if you or someone you know have provided tips to Crime Stoppers, you might want to take extra care that you haven’t been doxxed.

Image credit: Shutterstock

Source: CBC