Securify

An Ohio-based school safety vendor has disclosed a massive data breach that compromised approximately 8.3 million anonymous crime-tip records — including student Social Security numbers, medical information, and behavioral threat assessments — in what is now the subject of a U.S. Department of Justice criminal investigation and congressional inquiries.

What Happened

Navigate360, a company whose Campus360 platform provides panic buttons, threat detection, and anonymous tip-line infrastructure to more than 35,000 schools across the United States and Canada, revealed on October 23 that an unauthorized party had accessed its systems between November 21, 2025, and March 5, 2026 — a window of more than three months.

During that time, the attacker copied roughly 8.3 million records from the company’s anonymous tip-line databases serving public safety agencies across multiple U.S. states. Navigate360 says it first detected suspicious activity around March 18, 2026, but public disclosure did not come until seven months later, a delay that has drawn sharp criticism from state officials and child safety advocates.

The breach first came to public attention through researcher David Riedman, who runs the K-12 School Shooting Database. The stolen data was subsequently released by Distributed Denial of Secrets (DDoSecrets), a nonprofit whistleblower platform, as a 91.53 GB dataset made available to researchers and journalists.

What Data Was Exposed

The scope of the compromised data is alarming, particularly given that it involves minors. Depending on the record, the exposed information may include student names and the names of parents or family members, home addresses, phone numbers and email addresses, dates of birth, student ID numbers, Social Security numbers, and information about medical conditions or treatment.

Beyond the personally identifiable information, the breach also exposed the content of anonymous tips themselves — reports about alleged crimes, threats, and behavioral concerns submitted through systems like Nevada’s SafeVoice tip line. According to Riedman, the dataset spans nearly four decades of submissions, making it one of the most sensitive collections of student-related data ever compromised. Claims by the alleged hacker, who goes by the handle “Internet Yiff Machine,” suggest that administrator credentials were stored in unencrypted plaintext files, which were used to create fake customer accounts and export data at scale.

A particularly troubling detail is the alleged “Session Information Disclosure” feature that exposed tipsters’ IP addresses within a 90-day window, directly undermining the anonymity that is the entire premise of these reporting systems. If tipsters can be identified, the chilling effect on future reporting of genuine threats to school safety could be severe.

Who Is Affected

Navigate360’s reach is enormous. The company says its platforms serve approximately 19 million students, more than 5,000 law enforcement agencies, and 4,400 businesses. Major school districts listed as Navigate360 customers include Miami-Dade, Philadelphia, Omaha, Portland, Denver, Salt Lake City, Broward, Hillsborough, and Detroit Public Schools, though the company has not confirmed which districts had data compromised.

Nevada was the first state to officially confirm that its SafeVoice tip line was affected, with the Nevada Department of Education issuing a warning to families on October 22. State officials said roughly 10 percent of SafeVoice tips containing personally identifiable information from the breach window were compromised. Critically, because the system is designed to be anonymous, Nevada cannot reliably contact all affected students and families directly and is relying on public notices instead.

Other states are expected to be affected, but none beyond Nevada have been publicly named. The Nevada Department of Education says it is coordinating with education leaders in other states whose schools may also be impacted.

The Delayed Disclosure Problem

Nevada officials have been blunt in their criticism of Navigate360’s handling of the breach. According to the state, Navigate360 first notified Nevada in spring 2026 that SafeVoice “may have been affected” by a criminal multistate cybersecurity incident and that a forensic investigation was underway. However, the company reportedly sent incomplete impact reports over the following months, and it was not until October 2026 that Nevada was told the compromised records actually contained students’ personal information.

That seven-month gap between the breach’s discovery and full public disclosure is a recurring pain point in the education technology sector, where breach notification standards are often less rigorous than in healthcare or finance. For families whose children’s Social Security numbers may now be in criminal hands, those months represent lost time for protective action like credit freezes.

A Pattern in EdTech Security

This is not the first time a school safety vendor has suffered a catastrophic breach. In 2023, Raptor Technologies — another threat assessment platform — exposed approximately four million records, including evacuation plans, threat reports, medical records, and court documents, through unencrypted PDF files left on an open cloud storage system.

The Navigate360 incident raises fundamental questions about whether sensitive student safety data should be entrusted to private vendors at all. Riedman has argued that threat reporting should be a federal function, modeled on something like the National Poison Control Center, rather than a patchwork of private platforms with varying security standards. “That is the most sensitive information possibly available about a child,” Riedman told Cybernews.

What You Should Do

If your child attends a school that uses Navigate360, SafeVoice, or any Campus360-linked tip-line system, there are several steps worth taking now.

First, consider freezing your child’s credit with all three major bureaus (Equifax, Experian, and TransUnion). A stolen Social Security number belonging to a minor can go unnoticed for years because children typically do not apply for credit, making them ideal targets for long-term identity fraud.

Second, watch for targeted phishing. Attackers who know a child’s school, name, and family details can craft convincing messages impersonating school officials or safety services. Be skeptical of any unsolicited communication referencing school safety or tip-line activity.

Third, monitor official channels. Navigate360 has set up an assistance hotline at 833-966-1754 (Monday through Friday, 6 a.m. to 6 p.m. Pacific). The company says it has hired a data mining firm to review the stolen data and determine the full scope of impact, and it is expected to issue its own breach notice under a court order.

Finally, check with your school district directly to ask whether they use Navigate360 products and whether they have received notification about the breach. Some districts may be in the process of evaluating alternative vendors — Nevada has already begun doing so.

The Navigate360 breach is a stark reminder that the systems we build to protect children can themselves become vectors of harm when security is treated as an afterthought. As school safety technology continues to expand, the standard of care for protecting the data it collects must expand with it.