Over a million Canadian tips leaked from Crime Stoppers database

And that's my mom's phone number right there. Remember these ads? Crime Stoppers. Crime Stoppers. Crime Stoppers. Crime Stoppers is a non-profit tip line. It's meant to be a private way for people to report crimes without having to talk to the police or testify in court. These messages are encrypted for your protection. It's all based on the promise that tips are always anonymous. The reputation of this program depends on keeping the tipsters anonymous. Anonymous. Anonymous. Well, not anymore. A hacker has leaked over 8 million Crime Stoppers tips. And now CBC has them all. Very worried about it. I'm kind of flabbergasted here. Kind of nervous and kind of look over my shoulder. Crime Stoppers says its tips have helped solve hundreds of thousands of crimes and catch suspects who might have otherwise got away if not for anonymous tips. The RCMP says it's concerned that this breach could jeopardize public safety including the safety of tipsters, individuals identified in tips, and police officers. The hacker says they breached the Crime Stoppers database in March. They made off with millions of tips from all around the world. About one and a half million of those were sent to Canadian Crime Stoppers. They were loaded with personal details, names, phone numbers, emails, home addresses, info on the tipster or the people they're reporting. So what did Crime Stoppers say about the leak? Over seven months after the hack, we asked the Canadian Crime Stoppers Association for an interview. It didn't give us one, but it sent a statement. It said, If there is information within the leaked records that could identify people who submitted tips, it's an extremely serious issue. But it didn't confirm or deny whether any personal information was in the leak. The data told a different story. Thousands of reports had what looked like unredacted full names of tipsters who identified themselves. CBC wasn't able to verify that all these names were legitimate. We did talk to a few tipsters to see how they felt knowing a hacker got their confidential tip. We actually have your tip right here. Oh. This is Andrew Rivard. Wow. He reported a convenience store that was selling illegal cigarettes to minors. Yep, that's exactly what I submitted to them. Rivard says he's worried that the people he reported could come after him. But he's even more concerned for tipsters who reported serious violent crimes. It shouldn't have gotten leaked, though. As Crime Stoppers, you'd think it would be more secure, right? And exactly, it's supposed to be anonymous. This woman gave a tip after someone close to her was killed. Police have now laid murder charges. It's been very scary. I've had anxiety. CBC is concealing her identity and her voice. Someone else is reading her comments. She's afraid if the person charged with murder finds out she gave a tip, she or her family could be in danger. I think it would be putting us in a dangerous situation because who knows? They were capable of hurting my loved one. They could come back and hurt one of us. She says she was afraid to submit a tip to Crime Stoppers. She didn't fully trust their promise of anonymity, but wanted to help police find the killer. So how did this happen? Crime Stoppers tells tipsters not to include anything that could reveal their identity, like names or contact info. Sometimes things that seem harmless can give them away. Even describing how they know the suspect, or how they learned about the tip they're reporting, could sometimes identify them. Crime Stoppers put a flag on these tips. Tipster exposed, but often didn't remove the identifying details. Both the people we interviewed were exposed tipsters. Crime Stoppers keeps its tips in a database called P3. It's run by Ohio-based company Navigate360. It didn't respond to our request for an interview. A hacker who goes by the name Internet Yiff Machine leaked it to an American nonprofit called Distributed Denial of Secrets, which then shared it with CBC. We asked the hacker how they got their hands on the tips. They said it was actually really easy because the security measures P3 had in place were terrible and that they were expecting far more security. The hacker says they used a stolen digital key to break into a single Crime Stoppers chapter. They realized that the key could actually unlock tips from every Crime Stoppers on the network, giving them access to millions of tips. The system seems to be failed in the promise of anonymity. Ali DeGantana says he has doubts on whether it was really that easy hack into the database. When he saw a sample of the data, he said the platform failed a lot of basic data privacy requirements. He said it should have encrypted the tips themselves, deleted tips that got too old to be useful, and it shouldn't have kept that much personal information. You can always outsource the work, but you cannot outsource the accountability. DeGantana says after a hacker has shared the data once, we should assume it could be publicly available. The tipsters we spoke to said Crimestoppers should have told them their info was leaked. The fact that they didn't do that, it's kind of gotten me worried and not really trusting to the justice system. The Canadian Crime Stoppers Association says that reaching out to exposed tipsters could put them in more danger. Yeah, I wouldn't want to do crime stoppers ever again. I'm not going to ever phone them again. Police forces say Crime Stoppers is invaluable. The data shows it's paid rewards to tipsters who reported things like a man sexually assaulting someone on the bus, a pimp recruiting women into the sex trade, and the killer of an indigenous woman. In the U.S., the FBI is investigating the leak, and there's a class action lawsuit against Navigate 360. Michelle Allen, CBC News, Winnipeg.