The fact that the information architecture was not designed to:
a) remove identifying information from the body of the tip, and
b) store identity as a separate database with locked down...

That's deep, deep negligence in program design.

"[The hackers] added that the security measures of P3, which was storing Crime Stoppers' tips, were "terrible" and that the platform is still vulnerable."

It's really saying something when the hackers are more responsible than the vendor. They have not yet leaked the contents of the hack except to journalists.