Science & Tech · Cybersecurity · 8 hrs ago
York University breach exposed personal information from departmental forms
An unauthorized actor stole personal information from online forms used by York University departments in Toronto.
The breach affected forms on 14 university websites, with records dating from 2007 to 2026.
The exposed details varied by person and included contact information, York ID numbers, academic histories and, in some cases, health or financial information.
York discovered the incident on October 25 and said most affected records contained basic contact details and York ID numbers.
The university has not said how many people were affected, and it has not provided details about who carried out the breach.
York says the forms are now secure, and people whose government ID or financial account information was exposed are being offered two years of credit monitoring and identity theft protection.
The investigation into the scope of the breach continues, while the university advises affected people to watch for suspicious messages and account activity.
York University said an unauthorized actor stole personal information submitted through online forms on 14 university websites.
The university discovered the incident on Oct. 25, 2026, and said it acted to contain it and secure the forms.
The affected forms received submissions between 2007 and 2026, and the exposed information varied by person.
Most compromised records contained basic contact details and York identification numbers, while some included sensitive health, financial or government identification information.
York said it would offer two years of credit monitoring and identity theft protection to people whose government identification or financial account information was exposed.
- Who
- York University and people whose information was submitted through its departmental forms.
- What
- An unauthorized actor accessed online forms and stole personal information.
- When
- The university discovered the incident on Oct. 25, 2026. The affected forms covered submissions from 2007 to 2026.
- Where
- York University in Toronto, Canada; 14 university websites were affected.
- Why
- Not stated.
This story does not have two clearly opposing sides.
The affected online forms received submissions during this period.
York University discovered the unauthorized access.
York said it acted to contain the incident, engaged outside experts and secured the affected forms.
CBC, BleepingComputer and SC Media published reports on the breach.
- Affected websites
- 14 departmental and faculty websites
- Discovery date
- Oct. 25, 2026
- Records covered
- Submissions from 2007 to 2026
- Common exposed data
- Contact information and York identification numbers
- Support offered
- Two years of credit monitoring and identity theft protection for people whose government ID or financial account information was exposed
4 sources
What people are saying
York was recently subject to a cybersecurity incident involving an unauthorized actor accessing limited online forms used by University departments
While York acted quickly to contain the incident following discovery, we regret to confirm the theft of personal information from some departmental forms
We recognize that this incident may be concerning to you. We take that seriously and regret these circumstances.
The university takes its responsibility to protect the privacy and security of its community seriously