Navigate360 Breach Exposed School Crime-Tip Records Across US and Canada

The Navigate360 data breach reached Nevada's anonymous school tip line, and state education officials said on Thursday that sensitive tip data was exposed. The vendor disclosed its own breach the next day. The copied records reach well beyond Nevada, touching school and police tip systems in multiple states and in Canada.

The headline figure is large, but it does not answer the question most readers ask first. About 8.3 million tip records are involved, and officials have not said how many people that represents.

What the Navigate360 data breach exposed in Nevada

SafeVoice is a 24-hour anonymous reporting system used by students, families, educators and community members. Tips arrive by phone, app and online form. Anonymity is the core design, which is why state officials say it may be difficult to notify each affected person directly.

According to an investigation reported by IBTimes UK, an unauthorized third party accessed one of Navigate360's systems and obtained copies of data between November 21, 2025 and March 5, 2026. Copied files may also hold Social Security numbers and other personal information, according to EconoTimes.

State officials have been blunt about the stakes. Dr. Victor Wakefield, Nevada's Superintendent of Public Instruction, said, according to News3LV: "The compromise of sensitive information is unacceptable."

How the timeline slipped from March to October

Navigate360 first noticed suspicious activity around March 18, 2026. In the spring, it told the state that SafeVoice might have been affected by a criminal multistate cybersecurity incident and that an independent forensic investigation was underway. Public warnings did not come until October, roughly seven months after the vendor first spotted the activity.

Nevada's account says the vendor's reports were incomplete at several points. After the state made demands, Navigate360 delivered another incomplete data impact report. Supplemental datasets arrived between October 9 and October 15, which gave the state enough information to assess exposure and issue warnings, as reported by 8 News Now.

This month, Navigate360 told the state that its forensic investigation concluded about 10% of SafeVoice Nevada tips containing personally identifiable information were compromised. The key dates are below.

The gap matters because the access window closed in early March, while the public learned of it in October. State officials dispute what Navigate360 told other customers before then, and that question remains open.

How many records and people are involved

The Navigate360 systems hold about 8.3 million tip records covering organizations in the United States and Canada, according to the incident page from Washoe County School District as reported by EconoTimes. That number counts records, not people. One person can file several tips, and one tip can name several people, so the number of individuals could differ sharply from the record count.

The Canadian figures are more specific. Toronto Crime Stoppers said Navigate360 reported 176,859 of its tips in the copied data, covering January 2022 through November 2025. The chapter later identified 14,973 names, but it could not say whether those names belonged to tipsters or to people named in reports.

A Nevada Department of Education FAQ says public reports indicate the incident may have affected more than 35,000 schools and 5,000 public safety agencies. That figure has not been independently confirmed, so treat it as unverified. Reuters reportedly could not independently verify the hacker's scope claims, according to Shattered.

Which tip records may contain personal data

Not every record holds personal information. Nevada says about 10% of SafeVoice tips containing personally identifiable information were compromised. Nevada officials also say the exposed tip data includes records linked to students, which raises the stakes for families.

The groups most exposed are students and families who filed tips through school safety systems, tipsters in Crime Stoppers programs, and schools and police agencies that used Navigate360 platforms across multiple states. Crime Stoppers USA said Navigate360 issued impact notifications to member programs. Those programs could request affected names and tip IDs by a September 25 deadline, according to a secondary summary from Mallory.

That deadline comes before the public warnings, which suggests some customers were notified months before the state went public. How much those customers were told is part of the dispute with state officials.

Vendor breaches like this one tend to spread across customers who never signed up for the same risk. Our earlier coverage of the PwC vendor breach shows how one provider's problem can reach many clients at once.

What Nevada and Navigate360 are doing now

Navigate360 has set up a call center to answer questions about the incident. State officials, with support from the governor's office, are evaluating alternative platforms with stronger security protections, according to 2News. Whether Nevada will end its Navigate360 contract is still under review, according to the Nevada Globe.

Congressional inquiries and a U.S. Department of Justice criminal investigation have followed the breach, according to News3LV. Who carried out the intrusion has not been publicly identified.

The structural problem is who holds the data. Schools and police agencies choose a platform, but the vendor stores the tips and runs the systems. When reports arrive in pieces, the state has to reconstruct what happened from partial data, which is what Nevada's timeline shows.

Schools facing intrusions this year have had their own disruptions. Richmond Public Schools cut internet across 53 campuses after an intrusion, and Oneonta City Schools stayed closed until Tuesday after a ransomware attack.

Practical steps for parents, schools and tipsters

Today is Saturday, so the Navigate360 line will not open until Monday, October 26. Use these steps once it does:

• Call Navigate360 at (833) 966-1754 on weekdays from 6 a.m. to 6 p.m. to ask whether your information was affected.
• Check any state, district or police notice for the platform name and the dates you submitted a tip, then compare those dates with the notice.
• Consider credit and data monitoring. The state encourages families to consider it, including for children under 18.
• Watch for unusual activity tied to a student's identity, such as credit files, accounts or bills in a child's name. Child identity misuse can go unnoticed for a long time.
• If you are worried about Social Security numbers, a credit freeze is free at each of the three major credit bureaus.

What to watch next

Three threads will shape the next few weeks. The first is whether Nevada ends its Navigate360 contract and which platform replaces SafeVoice. The second is whether the Justice Department investigation produces charges. The third is whether the 10% figure moves as forensic work continues.

Other states are still reporting, so expect more notices naming school districts and police agencies. The most reliable signals will come from official notices rather than aggregator summaries. The seven-month gap between the first suspicious activity and public warnings is likely to be central to any review of how the vendor handled notice.