A CBC investigation found that over 1.5 million tips have been submitted to Canada’s Crime Stoppers programs over the past 25 years.
Per CBC, this was compromised as part of a larger data breach and included the personal information of some tipsters. Of course, this has led to many people worrying that criminals who have their data could try to retaliate. (CBC, for its part, says it has taken “extensive precautions” in its own handling of tipsters’ sensitive information, including encryption and self-contained offline work environments.)
CBC reports that data from Crime Stoppers partner P3 Global Intel was stolen in March by the hacktivist group Internet Yiff Machine, which claimed it wanted to expose vulnerabilities in the company’s platform. US non-profit Distributed Denial of Secrets eventually provided data for researchers and journalists, including CBC, to study the impact and warn the public accordingly.
According to the CBC, more than 850,000 tips contained “personally identifiable information” about a variety of people, from tipsters and individuals named in allegations to Crime Stoppers personnel and police. Often these were street addresses and phone numbers, although CBC reports that “tens of thousands” of personal emails and license plates, as well as “hundreds” of bank details linked to cash rewards, were deleted. There have even been reported to be over 4,300 cases of tipsters providing full names, despite being told not to do so by Crime Stoppers.
Worse, staff are said to have warned in hundreds of cases that tipsters have been compromised because they either identified themselves as such or it ended up being discovered by Crime Stoppers. And yet the information was still unredacted in the agency’s database.
For context, CBC found that the Canadian Crime Stoppers breach contains tips related to particularly high-profile cases such as the mysterious murders of Barry and Honey Sherman, the case of Luka Magnotta, who killed and destroyed Chinese student Jun Lin, and the global manhunt for alleged drug lord Ryan Wedding.
Ultimately, the CBC concluded “that Crime Stoppers, along with the company it hired to manage its database, failed to protect the identities of tipsters, left personal information unredacted and improperly retained decades of sensitive records.”
CBC says several cybersecurity experts it spoke to were surprised it found the data online because they couldn’t themselves. But of course they acknowledged that such a leak meant that this data would almost certainly be available elsewhere, given the way the internet works.
All of this is to say: If you or someone you know has provided tips to Crime Stoppers, you may want to take extra care to ensure you don’t get doxxed.
Image credit: Shutterstock
Source: CBC