Toronto closed 2025 with some of its most encouraging public safety numbers in decades. Homicides fell nearly 47% to a 40-year low. Shootings were down 43%. Robberies declined by close to 20%. By most headline measures, the city had its safest year in a generation. And yet, one category moved in the opposite direction: theft over $5,000 - the only major crime indicator to increase year-over-year, rising 8.4% and continuing a steady upward climb that has persisted since 2021. That trend line deserves attention.
April 20, 2026
The Ten-Year Gap Nobody Talks About
The aggregate numbers obscure a more precise reality. A Globe and Mail analysis of Toronto Police Service data covering the decade from 2015 to 2025 found that while home invasions and break-and-enters fell 27% across the city as a whole, several of Toronto's highest-income neighbourhoods moved sharply in the opposite direction. Rosedale-Moore Park recorded a 145% increase over that period. Yonge-St. Clair rose 236%. Mount Pleasant East, 233%.
These are not marginal fluctuations. They represent a sustained, decade-long divergence between the city's overall crime trajectory and the experience of its most affluent communities. The improvement in Toronto's headline numbers is real. For residents of these neighbourhoods, it has been largely invisible.
How These Operations Actually Work
Understanding why requires looking at the structure of the threat rather than its volume.
The groups responsible for high-value residential crime in the GTA are not opportunistic. York Regional Police, in a February 2025 operation that resulted in 20 arrests, described suspects who had entered the country specifically to commit property crimes - not individuals acting impulsively, but operatives executing a prepared plan. A separate Peel Regional Police investigation concluded in July 2025 resulted in 12 arrests and 136 charges connected to two organized groups that had stolen over two million dollars in property across the GTA. Investigators noted that stolen vehicles were being shipped overseas through affiliated networks, with proceeds being reinvested into further criminal activity.
This is the operational logic that the aggregate crime data does not capture: a smaller number of incidents, each planned with greater precision, targeting environments that justify the preparation.
The Reconnaissance Phase
What sets organized residential crime apart from opportunistic break-ins is the work that precedes entry. Law enforcement and academic research consistently document a pre-operational phase that can span days or weeks before a property is approached.
Reconnaissance typically involves multiple passes of the target address by vehicle, often in rentals that blend into the neighbourhood. Schedules are mapped - when residents leave, when domestic staff arrive, when contractors are present, when the property is reliably empty. Entry points are assessed, camera positions noted, and alarm panel locations identified where visible.
In documented cases, GPS tracking devices have been placed under target vehicles to monitor movements prior to an operation. Court records from a 2024 federal case in the United States - which investigators connected to an international network responsible for over 1.6 million dollars in losses across 19 properties - showed that perpetrators had built detailed profiles of each target using data brokers, public property records, Zillow, and social media before conducting any physical surveillance.
The Digital Exposure Problem
This points to a dimension of residential risk that most households have not meaningfully addressed.
Organized burglary groups now conduct a significant portion of their target assessment online, before any physical contact with the neighbourhood. Property records indicate ownership and assessed value. Social media reveals travel patterns, family schedules, and the presence of high-value items. Platforms like Instagram and Facebook have been cited by law enforcement in multiple jurisdictions as primary intelligence sources used by burglary crews to identify when a property will be unoccupied.
The NBA, NFL, and NHL each issued security bulletins to their organizations in November 2024 warning of organized groups - specifically described by FBI intelligence as transnational networks - that were cross-referencing game schedules with social media and public records to identify when high-value targets would be away from home. The method is not unique to professional athletes. It scales to any household whose occupancy patterns, assets, or travel habits are visible in the public domain.
A security camera does not address this phase. An alarm system does not address this phase. The exposure has already occurred by the time a physical approach is made.
The Timing Window
Seasonal and scheduling patterns add another layer to the risk profile.
The December 2024 to February 2025 period saw a 27% increase in residential break-ins in the GTA compared to the same window the previous year - the highest seasonal spike documented in recent cycles. Extended holiday absences, predictable departure and return windows, and reduced neighbourhood presence during winter months create conditions that organized groups have demonstrably learned to exploit. Toronto's 53 Division, covering North Toronto, issued multiple community advisories during this period specifically citing recurring crews targeting affluent homes.
The operational preference for these windows reflects the same logic as the target selection itself: maximum yield, minimum exposure.
What This Means for Protective Posture
The picture that emerges from the data is specific. It is not a story of random crime affecting random households. It is a story of deliberate selection, pre-operational intelligence gathering, schedule exploitation, and coordinated execution - applied consistently to the same category of target, in the same category of neighbourhood, over a sustained period.
An alarm system signals to a monitoring centre after a breach has begun. A camera records what happened after entry has been made. Neither addresses the reconnaissance phase. Neither affects the operational calculus of a team that has already profiled the property, assessed the response window, and identified the entry point.
The shift in protective logic required is not one of technology. It is one of posture. Deterrence operates before the approach. Detection operates during it. Response operates after it. A serious residential security architecture addresses all three - with active ground presence, monitored perimeter intelligence, and command capability that compresses the response window to the point where it eliminates the operational margin these groups depend on.
The aggregate improvement in Toronto's crime environment is real and meaningful. But for individuals and families whose exposure is defined not by neighbourhood averages but by what they own, where they live, and what is visible about them, the relevant trend line runs the other way.
Understanding that gap - and building the architecture to close it - is the starting point for any serious security posture.
