Loading story…
A reported breach of Navigate360's P3 anonymous-tip systems allegedly exposed 8.3 million tips submitted through services used by schools, communities, Crime Stoppers programs, law enforcement, and the military. The compromise was publicly claimed by a hacktivist roughly six months earlier, raising serious concerns because the platforms represented submissions as anonymous and may contain highly sensitive information.
Affected tipsters reportedly had not received direct notification as of September 17. Crime Stoppers USA said Navigate360 had issued impact notifications to member programs; those programs can request affected-person names, tip IDs, and the company's proposed public notice by September 25. Navigate360 was reportedly considering a general public notice in late September, while questions remain over remediation of the alleged security weaknesses and the reliability of its anonymity protections.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Crime Stoppers USA sent member organizations a communication about the Navigate360 data breach and advised P3 and P3 Campus users to communicate directly with Navigate360.
DataBreaches began reporting on Navigate360's lack of public transparency concerning the reported compromise.
A hacktivist announced they had accessed and acquired 8.3 million tips from Navigate360-associated anonymous-tip systems used by schools, communities, Crime Stoppers organizations, law enforcement, and the military.
Navigate360 reportedly intended to issue a general public notice in late September. Programs were given until September 25 to request affected-person names, affected tip IDs, and the proposed notice, while affected individuals reportedly had not yet been directly notified.
Navigate360 reportedly emailed programs initial impact reports identifying the number of people whose personal information could have been affected in connection with each program.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A group calling itself **Internet Yiff Machine** claims it breached P3 Global Intel, a tip-reporting platform owned by Navigate360 and used by law enforcement, schools, and government agencies, and stole about **93 GB** of data containing roughly **8.3 million** tip submissions. Reports say the exposed records include tip reports, conversations with tipsters, personal information on both tipsters and accused individuals, internal support tickets, and internal pages describing user-tracking features, including a confidential **"Session Information Disclosure"** capability that could let clients request a tipster’s IP address. The alleged leak is especially sensitive because P3 serves more than **30,000-35,000 schools** and multiple US government entities, and the data may include student safety, mental health, bullying, drug, and suicide-threat reports. The attackers said they exploited multiple security weaknesses, including an alleged lack of encryption and missing rate limiting that allowed them to exfiltrate the full database. Navigate360 said it hired a third-party digital forensics firm to investigate but has not confirmed that sensitive information was accessed or misused. Even without formal confirmation, some users of the platform are treating the incident as credible; **Portland Police** advised the public to temporarily avoid submitting tips through its Crime Stoppers service while the matter is reviewed.
Jun 29, 2026
Navia Benefit Solutions, a Washington-based third-party workplace benefits administrator serving more than 10,000 U.S. employers, disclosed a cyberattack that gave unauthorized actors read-only access to its network between **December 22, 2025, and January 15, 2026**. The company said the breach may have affected **2,697,540 individuals** and exposed a broad set of personal and benefits data, including names, dates of birth, Social Security numbers, phone numbers, email addresses, and enrollment information tied to **FSA, HRA, and COBRA** accounts, with some records reportedly dating back to 2018. Navia detected suspicious activity on January 23 and said it notified federal law enforcement and regulators, including the **U.S. Department of Health and Human Services**, in a breach reportable under **HIPAA**. Notification letters began going out on March 18 after a substitute notice was posted on March 13, and the company is offering **12 months of credit monitoring and identity theft protection** through Kroll. One confirmed affected client, the **Washington State Health Care Authority**, said the incident involved records spanning seven years for tens of thousands of **PEBB, SEBB, and COFA** members, as well as data linked to 37 school districts; Navia has not said ransomware was involved and no ransomware group has claimed the attack.
Jun 29, 2026
SoundCloud, Pornhub, and 700Credit have each confirmed significant data breaches impacting millions of users. SoundCloud reported unauthorized access to an ancillary service dashboard, affecting approximately 20% of its 140 million users—about 28 million people. The exposed data included email addresses and information already visible on public profiles, with no passwords or financial details compromised. The incident also caused temporary connectivity issues for some users, particularly those using VPNs, due to configuration changes made during the response. Pornhub notified select Premium subscribers that some user data was exposed following a breach at Mixpanel, a third-party analytics provider, but emphasized that sensitive information such as passwords, payment details, and government IDs were not affected. Pornhub had ceased using Mixpanel in 2021 and was informed of the breach by the vendor. 700Credit, a US-based provider of credit and identity verification services, suffered a third-party supply-chain attack that compromised the personal information of approximately 5.6 million individuals. The breach, which occurred between May and October 2025, involved unauthorized access to names, addresses, dates of birth, and Social Security numbers through a compromised API used by one of 700Credit's integration partners. 700Credit has since shut down the affected API, notified federal authorities, and is offering credit monitoring to victims. These incidents highlight the ongoing risks posed by third-party service providers and the importance of timely breach notification and response.
Jun 29, 2026