Navigate360

Navigate360 runs anonymous tip platforms used by roughly 30,000 schools, Crime Stoppers chapters, law enforcement agencies and the military. Programs built on it include Safe2Tell, Safe2SayPA and reporting lines operated with Sandy Hook Promise. A hacker took 8.3 million tip records.

The breach was first reported in March 2026. Six months later, no tipster has been notified. Navigate360 signalled in September that it intends to publish a general public notice in late September, which is a different thing from telling 8.3 million people individually that their submission was taken.

Tip reports and the full conversation threads that followed them. Personal information on the people who submitted tips and on the people they accused. Reporting also described internal documentation of user-tracking features, including a confidential capability that lets a client request the IP address behind a submission.

That last item is the one that matters. The platform was sold on anonymity and retained the means to undo it. A tip about a classmate planning self-harm, a report about a parent, a warning about a teacher: each arrived with a name attached somewhere in the record, whether or not the person typing it knew.

Children, mostly. The reporting programs attached to this system exist so a fifteen year old can say something about a friend who is in trouble without becoming the person who said it. The accused are in the set too, named in reports that were never tested and in many cases never substantiated.

An unsubstantiated accusation is still a document. It sits in the record with a name on it, and now it sits wherever the hacker put it. For the tipsters, the harm is the specific one they were told could not happen. Several expressed fear for their safety if their identity became known. That is why they used a system that promised it would not.

The anonymity promise was the product. Navigate360 sold reporting rates, and reporting rates depend on the belief that reporting is safe. Schools bought it for exactly that reason, and the programs built on it carry state backing and public branding.

Retaining identity data alongside an anonymous submission is not automatically wrong. Law enforcement follow-up sometimes requires it, and a tip line that can never be traced can never be verified either. The failure is not that the data existed. It is that the promise made to the person typing did not match the record the system kept.

Six months from first report to a planned public notice suggests the inventory took longer than the intrusion did. A company that could state on day one which tips carried identifying details and which did not would have been able to notify the affected subset quickly and say so.

Instead the public position has been silence, then a general notice. A general notice is what an organization publishes when it cannot produce a list. Eight million records across 30,000 institutions, submitted through multiple branded programs over years, is precisely the kind of estate where nobody has a current map of what is inside.

The distinction that decides notification here is narrow and entirely answerable in advance: which records contain a tipster identifier. That is a content question about the data, and it was available to be answered at any point before a hacker forced it.

No ransomware group has claimed this. There is no leak site post and no ransom demand in the public record, which is part of why it moved so slowly. Extortion creates a deadline and a headline. A quiet theft creates neither.

United States senators have since demanded answers, which shifts the pressure from journalism to oversight. That is now the most likely source of a full account, and it will arrive long after the records did.

Separating the tip from the tipster at the point of collection. If the identifying fields live in a different store, under different access control, with a documented retention window, then a breach of the tip archive does not expose the child who reported.

Short of that, knowing which records carried identity before anyone asked. The six month gap between the breach becoming public and a notice being drafted is not a legal delay. It is the time it takes to find out what you were holding, done in the worst possible order.