Threat intel
Navigate360 tip line breach: what schools should ask now
Seven months after hackers claimed 8.3 million tips from P3 Global Intel, Nevada has disclosed its share. What happened and what tip line owners should do.
P3 Global Intel, a subsidiary of Navigate360, runs the software behind anonymous tip lines used by Crime Stoppers programs and by school safety lines in many US states. In March 2026 a hacktivist group calling itself Internet Yiff Machine said it had taken about 93 GB from the platform, including roughly 8.3 million tips dated from February 1987 to November 2025. Navigate360 says its products serve more than 30,000 schools and 5,000 public safety agencies; some reports put the school figure above 35,000.
The story moved this week. On October 22 the Nevada Department of Education (NDE) and Department of Public Safety said a forensic review commissioned by Navigate360 found that about 10% of SafeVoice Nevada tips containing personally identifiable information (PII) were compromised, in an intrusion that ran from November 2025 to March 2026. Nevada says it cannot notify the people affected directly, because the line is anonymous, and that Navigate360 must publish a substitute public notice under a court order by the end of October. If your school, district, police agency or company runs any anonymous reporting service through a vendor, this is the case to learn from.
What was taken, and what is still unconfirmed
Reuters reported the claim on March 18 and could not independently verify its full scope. Straight Arrow News (SAN), which received the data from the group, said it confirmed parts of it by contacting people listed in the records. The nonprofit Distributed Denial of Secrets (DDoSecrets) also received a copy and said it would share it only with vetted journalists and researchers.
According to SAN and Malwarebytes, the records include names, home addresses, phone numbers, dates of birth, licence plates, Social Security numbers and criminal histories of people named in tips. Some tipsters' own details appear too, along with user account data, support requests, law enforcement bulletins and, allegedly, the unencrypted message IDs and passwords tipsters use to check back on a report. School tips covered bullying, self-harm and threats of violence. Nevada's FAQ adds that the exposed education data can include student ID numbers, student and parent names, and medical or treatment details.
Navigate360's first public line, from CEO JP Guilbault, was that it had "not confirmed that any sensitive information has been accessed or misused." It later acknowledged the breach to clients, hired an outside forensics firm (HaystackID) and brought in the FBI. A Department of Justice investigation is ongoing. The platform stayed online throughout, although Portland Police asked residents to stop using its Crime Stoppers line for a time.
How an anonymous line stops being anonymous
A tip platform promises that the receiving school or agency never learns who sent a tip. That promise covers the sender's identity field and nothing that people type. A worried parent names their own child; a student describes a conversation only two people heard; a caller leaves a callback number for the follow-up. Once that text sits in a vendor database for years, anyone who copies the database holds it in clear.
Three design choices decide how bad a leak is. First, whether free-text tips and chat transcripts are encrypted with keys the vendor's application tier cannot use in bulk. Second, how follow-up works: if the tipster's case ID and password are stored readably, the attacker can match tips to returning reporters. Third, retention. A dataset that starts in 1987 suggests old programme records were migrated in and never purged, so a breach in 2025 exposed reports made decades earlier by people who are now adults.
What the senators asked, and why it still matters
On April 24, Senators Maggie Hassan (D-N.H.) and Jim Banks (R-Ind.) wrote to Navigate360, giving it until May 8 to explain its security controls, how the attacker got in, what data was taken, how many people were affected, whether tips are truly anonymous, how many staff can read sensitive data, whether it has shared data with law enforcement or under court order, and what help it has given schools. We found no published answers.
Nevada's timeline shows why those questions are the right ones for any customer to ask early. The state received a preliminary, unverified report in June, then a draft public notice and data impact report in September that officials judged insufficient. A second report on October 6 was also incomplete; supplemental data came on October 9, 14 and 15. The state has since issued a Request for Information (RFI) for a replacement platform.
What to do if you run a tip or reporting line
If you are a P3 or Navigate360 customer today. Ask in writing for your own data impact report: the record counts for your programme, the date range, which fields held PII and whether your free text and follow-up credentials were in the copied set. Ask when the substitute notice will be published and what it says about your programme, so your own statement matches it. Tell staff not to search leaked copies of the data themselves.
Check your notice duties. Many US state breach laws, such as Nevada's NRS 603A, allow substitute notice (website and media) when direct notice is impossible. Education records may also fall under the Family Educational Rights and Privacy Act (FERPA). Your contract decides who sends notice and who pays; read that clause now rather than after the next incident.
Prepare the message to your community as well. Families need to know which years and which channels are affected, whether to consider credit monitoring or freezes for children, where to call, and that the line still works. Keep identifying details out of public statements.
Shrink what you hold. Set a retention period for closed tips, measured in months for most cases, with longer holds only where a law or open investigation requires them, and get the vendor to confirm deletion, including from backups and migrated legacy data. Ask the vendor to strip or encrypt contact fields once a case closes.
Build anonymity into the form. Warn reporters on the submission page not to include their own name unless they want contact. Issue follow-up codes that the vendor stores only as salted hashes. Confirm the platform does not log reporters' IP addresses or device identifiers against tips, or that it deletes them quickly.
Rewrite your vendor questionnaire. Use the questions in the graphic above at the next renewal, and ask for a recent penetration test summary covering the tip intake and case management apps.
The wider lesson
Whistleblower and safeguarding tools concentrate the most sensitive things an organisation hears, and buyers usually compare them on features while asking little about storage. Treat them like a health records system: short retention, encryption the vendor cannot casually undo, and a notification plan agreed before you need it.
Our compliance and audit readiness team can turn these questions into a vendor review and an incident notification plan, and our web penetration testing work tests whether a reporting portal's anonymity holds up against a real attacker. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would run the work.
Sources: Nevada Department of Education press release, October 22, 2026, Nevada Department of Education FAQ on the Navigate360 breach, KOLO TV, News 3 Las Vegas, Straight Arrow News on the senators' letter, CyberScoop, MeriTalk, Malwarebytes, Reuters via WHBL.