Navigate360 said on October 23, 2026 that hackers accessed one of its systems and copied months’ worth of data, according to reports from Reuters, The Next Web, teiss and shattered.io. The company confirmed the intrusion roughly seven months after a hacker first claimed to have breached its P3 Global Intel tip platform. That claim, made in March 2026, put the stolen haul at 93 gigabytes, including 8 million confidential crime tips.
P3 Global Intel is described as a Navigate360 “tip intelligence platform,” and the Navigate360 breach now ranks among the more sensitive disclosures of the year. Crime tips are not ordinary customer records. They often hold names, accusations, and details that people shared because they expected confidentiality. Navigate360 said potentially exposed information includes names, addresses, dates of birth, Social Security numbers, and other sensitive information.
The disclosure lands in a crowded stretch for public-sector data security. Readers tracking this beat will recall the Pentagon DMDC breach lawsuit covering 3 million-plus people, which also turned on a long gap between intrusion and public detail. This article walks through what Navigate360 confirmed, what the hacker claimed, what nobody has verified, and what the delay means for the market.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Navigate360 Confirmed on October 23
The company’s statement is short on specifics. Navigate360 acknowledged that an unauthorized party reached one of its systems and copied data covering several months. It did not publish a count of affected individuals. It did not say how many of the stolen records were tips versus account or support data.
Reports say the unauthorized access ran from November 21, 2025 to March 5, 2026. That window is about three and a half months. The company also said potentially exposed data covers names, addresses, dates of birth, Social Security numbers, and other sensitive information. The phrase “potentially exposed” matters, because it signals that Navigate360 has not tied each data type to a specific confirmed victim.
Navigate360 CEO JP Guilbault gave a measured line in earlier reporting. He said, “To this point, we have not confirmed that any sensitive information has been accessed or misused.” That sentence sits awkwardly beside the October 23 admission that hackers copied data. Both statements can be true at once, since copying data from a system is not the same as confirming that a given person’s Social Security number sat in the copied set. Still, readers should weigh the two together.
The company also said earlier that it hired a third-party forensics firm to determine whether a breach occurred. The October 23 acknowledgment suggests that review has now produced at least a partial answer. No public report from that firm has surfaced in the coverage reviewed for this story.
Timeline: From Intrusion Window to Public Admission
The sequence of events explains why security researchers focus on disclosure speed. Each row below comes from the reporting on this case.
| Date | Event | Status |
|---|---|---|
| February 1987 to November 2025 | Span of dates covered by the reportedly stolen records | Reported |
| November 21, 2025 | Unauthorized access window opens | Reported |
| March 5, 2026 | Unauthorized access window closes | Reported |
| March 2026 | Hacker “Internet Yiff Machine” claims breach of P3 Global Intel | Claim |
| After March 2026 | Navigate360 hires third-party forensics firm | Company statement |
| October 23, 2026 | Navigate360 acknowledges hackers copied months of data | Confirmed |
Count the gap from the closing of the access window on March 5 to the public acknowledgment on October 23. That is about seven and a half months. For comparison, many US state breach-notification laws set deadlines measured in weeks or a few months once a company confirms an incident, which is why the timing of when Navigate360 considered the breach confirmed will draw scrutiny.
The Hacker’s Claim: 93 GB and 8 Million Tips
In March 2026, a hacker using the handle “Internet Yiff Machine” claimed to have breached P3 Global Intel. The claim listed 93 gigabytes of data, including 8 million confidential tips. Reporting from teiss and other outlets has treated the figure as the hacker’s own assertion, and so should readers.
Hacker claims vary widely in accuracy. Some inflate numbers to raise pressure on victims, and others understate what they hold. Here the later reporting describes approximately 8.3 million tip records, a figure close to the original claim. That near-match gives the claim some weight, but it does not prove how many people those records describe.
Nothing in the available reporting identifies the person or group behind the handle. No ransom demand has been reported. The motive remains unknown, and this article does not speculate on it.
Reading the Numbers: 8 Million vs. 8.3 Million
Two figures circulate. The hacker said 8 million confidential tips. Other reporting described approximately 8.3 million tip records. The gap of about 300,000 is small, and it likely reflects different counting methods, such as whether support tickets and account rows get counted alongside tips.
The reported records included crime tips, user-account details, and customer-support requests, per the coverage. That mix means the headline count is not a count of people. One person might file several tips. A single tip might name several people, including suspects, witnesses, and third parties who never touched the platform at all.
Nobody has confirmed that all 8 million or 8.3 million records contained personal information. Nobody has confirmed the number of affected individuals. Anyone who quotes “8 million victims” is overstating what the evidence supports.
What Data Types Are Potentially Exposed
Navigate360 listed four categories: names, addresses, dates of birth, and Social Security numbers, plus “other sensitive information.” The first three enable impersonation and targeted phishing. The fourth, a Social Security number, enables identity theft and fraudulent credit applications, which is why it drives most notification and credit-monitoring decisions in the US.
The reported records also include the tips themselves and customer-support requests. The tip text may be the most harmful category, since it can link a named person to an accusation. Support requests can reveal who administered or used the platform and what problems they reported.
| Data category | Source of claim | Main risk if exposed |
|---|---|---|
| Names and addresses | Navigate360 statement | Targeted phishing, doxxing |
| Dates of birth | Navigate360 statement | Identity verification fraud |
| Social Security numbers | Navigate360 statement | Identity theft, credit fraud |
| Crime tips | Reported records | Retaliation, loss of anonymity |
| User-account details | Reported records | Credential reuse attacks |
| Customer-support requests | Reported records | Social engineering, context leaks |
Why Crime Tip Data Is Different
A retail breach exposes shopping habits. A crime-tip breach can expose accusations. People submit tips on the belief that their identity stays protected, and that belief is the product. If the belief breaks, the damage extends past the individual to the willingness of the public to report anything at all.
The date range of the reported records, February 1987 through November 2025, suggests the platform ingested or archived material from a long period. This analysis treats that span as reported, not verified. If it holds, some of the data predates the platform’s modern form and may have come from migrated systems, which tends to raise retention questions: why did a tip platform still hold records that old?
Security teams in health care face a similar problem. When Quest Diagnostics disclosed an incident tied to a single system, the story centered on how one platform could hold sensitive records for many downstream parties. Our coverage of the Quest Diagnostics Quanum LSM breach shows the same pattern of limited early detail followed by slow clarification.
What Remains Unconfirmed
Good breach reporting separates what is known from what is claimed. The table below does that for this case.
| Question | Current answer |
|---|---|
| Did hackers copy data from a Navigate360 system? | Yes, per Navigate360 on October 23 |
| When did unauthorized access occur? | November 21, 2025 to March 5, 2026, per reports |
| How many individuals are affected? | Unconfirmed |
| Did all 8M or 8.3M records hold personal data? | Unconfirmed |
| Was the data released publicly or accessed beyond the hacker’s claims? | Unconfirmed |
| Was a ransom demanded? | Unconfirmed |
| Who is the hacker? | Unconfirmed |
That is a lot of open rows for a company eight months past the end of the intrusion window. Expect journalists and state attorneys general to press on the individual-count question first, since it determines notification obligations.
The Seven-Month Gap: Disclosure and Accountability
The hacker’s claim surfaced in March. Navigate360 then hired a forensics firm to check whether a breach occurred. By October 23, the company confirmed that hackers copied months of data. Forensic investigations take real time, and companies often argue they cannot notify until they know what was taken. Regulators and plaintiffs usually answer that people at risk deserve a warning before the forensic report is polished.
Class-action firms watch for exactly this kind of gap. The Pentagon DMDC suit, mentioned above, is one recent example of litigation built around notification timing. A gap of this size gives plaintiffs a ready narrative, and it gives state regulators a reason to ask when Navigate360 first had reason to believe data had left its systems.
None of this proves wrongdoing by Navigate360. The company has described a forensic process, and the facts on when it reached conclusions have not been published. The takeaway: the timeline will be the center of any legal or regulatory fight, so expect it to be tested with documents rather than press statements.
Historical Context: A Pattern of Slow Disclosure
Long gaps between intrusion and disclosure are not new, but 2026 has produced several. Capcom’s account system leak came to light with a record count of 11.77 million, which we covered in our Capcom ID breach report. In India, the SBI data leak story involved 3,897 records appearing on the dark web. Each case differs in scale, but each followed the same rhythm: a claim, a denial or silence, then partial confirmation.
What sets the Navigate360 case apart is the nature of the content. Gaming accounts and bank records are sensitive, yet they are not built on a promise of anonymity. A tip platform sells discretion, and discretion is hard to restore once copied files exist somewhere outside the owner’s control.
How Breach Claims Usually Resolve
Hacker claims on forums typically fall into three outcomes. Some collapse under inspection, because the data is old or recycled. Others prove accurate once the victim finishes its forensics. A third group ends in partial confirmation, where the company agrees that data left its systems but disputes the scale. Navigate360’s wording, which confirms copying while avoiding a victim count, fits the third pattern so far.
Comparing Navigate360 to Other 2026 Breaches
Scale comparisons across breaches mislead when one case counts records and another counts people. The table keeps that distinction visible, using figures from our earlier reports on this site.
| Incident | Reported scale | Unit | Sensitivity |
|---|---|---|---|
| Navigate360 / P3 Global Intel | 8M claimed, about 8.3M reported | Tip records | Crime tips, Social Security numbers potentially |
| Capcom ID | 11.77M | Records | Account data |
| Pentagon DMDC | 3M+ | People | Personnel data |
| SBI leak | 3,897 | Records | Banking-related data |
| Quest Diagnostics Quanum LSM | 1 system, no count | System | Health-related data |
On raw numbers, Navigate360 sits in the middle. On sensitivity, it ranks near the top, because the possible downside includes harm to people who spoke to authorities or to institutions about someone else.
Market and Industry Impact
Navigate360 describes P3 Global Intel as a tip intelligence platform, which places it in the public-safety software market. Buyers in that market are often government bodies and institutions that answer to the public. Those buyers face procurement rules and board oversight, so a confirmed breach can trigger contract reviews, security questionnaires, and requests for audit evidence.
Competitors will use the news in sales conversations, and buyers will ask every vendor in the category harder questions about retention, encryption at rest, and logging. Public-safety technology is already under scrutiny in several US cities, as in the Chicago public-safety technology pilot across six districts, where data handling shaped the debate. A vendor breach adds fuel to that debate.
Navigate360 is a private company in the facts available here, and no stock-price impact can be cited. The more likely costs are legal, contractual, and reputational. They may include notification expenses, credit-monitoring offers, and customer churn, though no figures have been published.
What People Should Do Now
Navigate360 has not published an affected-person count or a public lookup tool in the reporting reviewed. Anyone who believes they used a P3 Global Intel service, or who submitted a tip through a program that used it, should watch for a direct notice from Navigate360 or the organization that deployed the platform.
- Place a free fraud alert or credit freeze with the major US credit bureaus if you suspect your Social Security number was involved.
- Change passwords for any account that reused credentials tied to a tip platform login, and turn on multi-factor authentication.
- Treat unexpected calls, texts, or emails that mention a past tip or support request as suspect.
- Check annual credit reports for new accounts you did not open.
- Keep any notification letter, since it may matter for later claims.
Organizations that deploy third-party tip tools should ask their vendor for a written incident summary and confirm whether their own data sat in the affected system. For broader reading on incident patterns, see the cybersecurity section of this site, and our report on the FBI and CISA SafePay ransomware warning covering 600 victims for how agencies describe victim notification.
Five Predictions for the Navigate360 Fallout
These are editorial judgments, not reported facts. They rest on how earlier breaches of this type have unfolded.
- An affected-person count will arrive within weeks. State notification rules and regulator inquiries tend to force a number once a company confirms copying.
- At least one class action will follow. The seven-month gap and the Social Security number exposure give plaintiffs both timing and harm arguments.
- Customers will demand audit evidence. Expect institutional buyers to request independent security assessments before renewing contracts.
- The tip-record count will get refined. The difference between 8 million and about 8.3 million likely narrows once Navigate360 separates tips from account and support rows.
- Retention policy will become a talking point. The reported 1987 to 2025 date range will push questions about why old records stayed online.
FAQ: Navigate360 and the P3 Global Intel Breach
What did Navigate360 announce on October 23, 2026?
Navigate360 acknowledged that hackers accessed one of its systems and copied months’ worth of data. The disclosure followed a March 2026 claim by a hacker who said they had breached its P3 Global Intel platform.
How many crime tips were stolen?
The hacker claimed 8 million confidential tips within 93 gigabytes of data. Other reporting described approximately 8.3 million tip records. Navigate360 has not confirmed either count.
What personal information may be exposed?
Navigate360 said potentially exposed information includes names, addresses, dates of birth, Social Security numbers, and other sensitive information. The company has not confirmed that any specific person’s data was misused.
When did the unauthorized access happen?
Reports place it between November 21, 2025 and March 5, 2026.
Has the stolen data been published online?
That is unconfirmed. Reports describe the hacker’s claims and some obtained records, but no verified public release has been established in the coverage reviewed.
Who is the hacker?
A person using the name “Internet Yiff Machine” made the March claim. The real identity, motive, and any ransom demand are unconfirmed.
What has Navigate360’s CEO said?
JP Guilbault said in earlier reporting, “To this point, we have not confirmed that any sensitive information has been accessed or misused.” The company said it hired a third-party forensics firm to determine whether a breach occurred.
Should I freeze my credit?
If you think your Social Security number was in a tip or account record tied to this platform, a free credit freeze is a low-cost precaution. Wait for an official notice for confirmation of your own exposure.
