More than 1.5 million crime tips gathered over about 25 years were compromised through vendor Navigate360, a CBC investigation reported, with the Privacy Commissioner opening an investigation on Oct. 27, 2026, and Law360 Canada reporting on Oct. 30 and Tech-Insider on Nov. 3. More than 850,000 identified tips contained personal information, a class action has been filed, and more than 40 chapters and agencies paused intake, while Quebec groups said on Nov. 3 the breach did not touch them, a point not confirmed in that coverage.
The sensitivity is obvious. People sent these tips expecting anonymity. When the platform holding them is breached, the harm lands on the tipster and on every local programme that trusted the supplier, not only on the supplier itself.
You outsource the software. You do not outsource the risk.
The lesson for any organization is plain: before entrusting a vendor with sensitive data, audit its safeguards, its breach notification duties, its retention rules and who can access the data, and write the answers into the contract. KSPACE TECHNOLOGIES puts that review inside managed IT and security care because supplier risk is now ordinary IT risk.
This week, list every outside platform that holds sensitive information for your organization, and name the person who last checked its safeguards. If a platform has no name beside it, that gap is your first vendor-risk finding.