01.04.2025
2 min
753
Hackers gained access to Navigate360 systems used by schools, police, and other US institutions to receive anonymous reports of threats and crimes. The massive data breach resulted in the theft of approximately 8.3 million records, potentially exposing the personal information of students, their parents, and other users.
On October 23, 2026, Navigate360, an American company that develops security software for educational institutions and law enforcement agencies, confirmed a major data breach. According to the investigation, unidentified attackers had unauthorized access to its systems from November 21, 2025, to March 5, 2026. During that period, they managed to steal approximately 8.3 million records related to reports of crimes, security threats, and other dangerous situations.
Navigate360 provides digital tools for emergency response, identifying potential threats, issuing security alerts, and anonymously reporting incidents to law enforcement. Its solutions are used by schools, police departments, private companies, and US military organizations. These services allow users to report suspicious activity, potential violence, threats to students, and other incidents requiring attention from the relevant authorities.
The company publicly acknowledged the incident only several months after the period of unauthorized access had ended. The announcement came one day after Nevada authorities disclosed that their SafeVoice system, which operates on Navigate360’s infrastructure, had been compromised. State officials accused the technology provider of delaying the disclosure of the breach’s full extent and providing incomplete information about its consequences.
One of the affected systems was SafeVoice Nevada, which allows students, parents, teachers, and other community members to anonymously report threats to children’s safety. The service operates around the clock, with reports submitted through a call center, mobile application, or web portal. According to the Nevada Department of Education, approximately 10% of SafeVoice reports containing personal information submitted between November 2025 and March 2026 were potentially compromised.
Depending on the individual record, the stolen information may have included students’ names, the names of their parents and other family members, home addresses, phone numbers, email addresses, dates of birth, student identification numbers, US Social Security numbers (SSNs), and medical and treatment information. Other exposed details may also have been sufficient, when combined, to identify individual students.
What makes the situation particularly concerning is that SafeVoice was specifically designed as an anonymous channel for reporting dangerous incidents. Because of the system’s anonymity protections, Nevada authorities cannot reliably identify everyone affected or notify them individually about the potential breach. As a result, state agencies issued a public notice and published information on the official SafeVoice website.
Navigate360 works with a large number of educational institutions and organizations. Its Campus360 education platform serves approximately 19 million students across more than 35,000 schools in the United States and Canada. The company’s clients include school districts in Miami-Dade, Philadelphia, Omaha, Portland, Denver, and Salt Lake City, as well as Detroit Public Schools.
In addition to educational institutions, Navigate360 technologies are used by more than 5,000 law enforcement agencies and approximately 4,400 businesses. However, it remains unclear how many of these organizations were affected by the cyberattack. What is known is that the incident impacted several US states and that the stolen information included records associated with schools and other public safety organizations.
The company said it had hired a specialized firm to conduct a detailed analysis of the stolen data and determine the full scope of the incident. Navigate360 also emphasized that it currently has no evidence that the information has been used for fraud or identity theft.
“Navigate360 has engaged a company specializing in data analysis to conduct a detailed review and determine the impact of the incident. We have no evidence that the stolen data has been used for fraud or identity theft,” the company stated on October 23, 2026.
According to Nevada officials, the breach did not disrupt local dispatch services, school response teams, or emergency assistance procedures. The SafeVoice system remains operational around the clock, allowing students and their families to continue reporting potential threats.
The Nevada Department of Education reported that the company first alerted state authorities to a possible compromise of SafeVoice in the spring of 2026. At the time, the incident was described as a criminal cyberattack affecting organizations in several states, and an independent digital forensic investigation was underway. However, over the following months, Navigate360 repeatedly provided incomplete information about the consequences of the attack, and confirmation that students’ personal data had been exposed did not arrive until October.
The situation attracted the attention of the US Congress, American media outlets, and the Department of Justice, which launched a criminal investigation. Nevertheless, according to Nevada officials, specific information about the attack’s impact on SafeVoice remained limited for a considerable period. In an October 22 statement, education officials emphasized:
“Navigate360 assured the state that SafeVoice continues to operate fully and remains available 24/7 for students and families who wish to report safety concerns.”
Nevada authorities said they are working with educational institutions in other states whose students were also affected by the incident and are demanding greater transparency and accountability from Navigate360. Representatives of the Department of Education and the Department of Public Safety are coordinating with schools and local law enforcement agencies to provide the necessary guidance to those affected.
For its part, the company announced additional security measures and said it was working with cybersecurity experts to strengthen the protection of its network, information systems, and data. Meanwhile, Nevada authorities have already begun evaluating alternative providers capable of ensuring adequate protection for confidential information.
The full extent of the incident is still being determined. The central concern is that a platform designed to provide a safe and anonymous way to report threats has itself become the source of a sensitive data breach. Some of those affected may never even learn that their information has fallen into the hands of cybercriminals.
