- York University indicates that an unauthorized person compromised personal information from digital forms of various departments dating back to 2007.
- The compromised data includes details about identification, academic records, contact addresses, health status, & financial information.
- York offers two years of credit monitoring to a small group and urges affected people to watch for fraud.
York University has confirmed that a cyber incident exposed personal information submitted through some departmental online forms. On October 25, 2026, the university became aware of the incident, stating that an unknown individual exfiltrated data from the forms.
The forms covered records dating back to 2007. Stolen details may include contact information, student ID numbers, academic records, & other personal details.
Online Forms from Several Departments Were Accessed
According to the university, the intruder gained access to a restricted set of forms available to some departments across the university. The forms are relevant for a few activities such as applications for residence, meeting registrations, and surveys. They did not belong to the main application, human resources, or student systems of York.
The affected forms collected information over many years. The public notice of York lists affected websites and the earliest year for each group. The periods start in different years, from 2007 onward, and end in October 2026. Some affected people may have submitted forms years ago.
The university has not said when the intruder first gained access or how long the person remained inside the forms. It also has not released the total number of people affected. York says it has identified affected groups and is notifying people whose information appeared in those forms.
However, the university’s list does not mean every person in an affected group lost every type of information shown. The details differ by person – but most stolen data involved basic information, including university ID numbers and contact details.
Stolen Data May Include Sensitive Personal Details
Depending on the particular type of form, stolen information can comprise educational and work details, immigration and date of birth, personal and business phone contacts, email IDs, plus home addresses.
Moreover, specific forms include more private data. Such details include financial status health-related information, disability & accommodation needs, information on nutrition-related issues, and checks on legal issues. Some records also held demographic details and photos.
York University mentioned a number of affected institutions. These include the Centre for Refugee Studies, Department of Psychology, Faculty of Graduate Studies, and Student Division. Faculty of Science and Housing and Conference Services are also on the list. The notice lists the affected websites, date ranges, and data types.
Further, the notice of York also explains that its data table describes information linked to each affected group. It does not mean every person in that group had all listed details stolen. This distinction matters because some forms asked for more information than others. People should check the relevant department and year rather than assume every listed data type applies to them.
Still, York says only a small number of people had government identification or financial account details exposed. The university plans to contact those individuals directly. It will offer them two years of free TransUnion credit monitoring and identity theft protection.
University Says Main Systems Remain Unaffected
After discovering the incident, York moved to contain it and brought in outside experts to investigate. The review examined the breach and the systems involved. York says investigators found no evidence that the intruder reached other parts of the university’s technology network.
The importance of containing cyber threats is also evident in previous major security incidents. In one notable case, a security researcher known as the “Accidental Hero” helped stop the biggest ransomware attack in history by discovering a critical vulnerability in the malware’s infrastructure. York has not explained how the intruder entered the forms or when the theft began. Its investigation continues.
York has reported the incident to law enforcement and the Information and Privacy Commissioner of Ontario. The commissioner oversees privacy matters in Ontario and may investigate the breach. People who believe the incident affected them can also file a complaint with the commissioner.
Meanwhile, York says it has added security improvements to the departmental forms. It has not provided technical details about those changes. York says it will keep reviewing its security measures and response plans.
What Affected People Should Do Now
York recommends individuals who possibly used the affected forms to stay alert to messages reaching them now. Therefore, it is important to be cautious in regard to emails, messages, or phone calls seeking personal data or sending them to unknown websites. This is because criminals can use the information they obtained to create more believable messages.
People should regularly check their bank accounts and other financial accounts for suspicious activity. In case something suspicious happens, they have to notify the financial service provider. They should also inform York and the Canadian Anti-Fraud Center.
Besides, people must create good passwords for all their online accounts. If they use the same passwords for multiple accounts, they may face serious problems in the future. Multi-factor authentication is a good way to secure accounts as it requires a person to verify the identity in a second stage after log-on.
People who fall within the listed groups can review the incident notice of the university to see whether their department and form period appear. Anyone who wants to know exactly which details York took about them can also send an email. York will verify the identity of each person before checking their records. Replies may take time because of the number of requests.
York also says most of the stolen information has no high risk of identity fraud on its own. However, the affected people should still stay alert and report suspicious activity quickly.
Share this article
About the Author
Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing. Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
More from Farwa SajjadRelated Posts
Hackers Use Hijacked WhatsApp Accounts to Spread Malware Disguised as Invoices
Cybersecurity agencies in Malaysia and Singapore warn about malware files sent through hacked WhatsA...
Apple Warns German Ministers and Lawmakers of Possible iPhone Spyware Attacks
Apple started sending spyware alerts to German ministers and lawmakers on October 29, and Germany...
Germany’s Charité Hospital Breach Exposes Names and Emails of 140,000 People
Hackers attacked the Charité webpage server and stole confidential information, including the names ...
Apple iOS 27 Child Safety Features Spark Unverified Surveillance Claims in Australia
Social media posts say Apple and Google now spy on private messages, video calls and photos in Austr...
Lazarus Group Targets South Korea in New Spy Campaign Using Post-Quantum Encryption
Kaspersky links a new spy campaign called Operation FlashHole to North Korea’s Lazarus Group. ...
Signal, Windscribe Threaten Exit Over Canada’s Six-Month Metadata Rules
Bill C-22 of Canada demands that telecoms and messaging applications retain the metadata of all of t...
