Breach · 4 min read
York University says personal details were stolen from departmental web forms going back to 2007
Toronto’s York University found someone in its departmental online forms on October 25. Most records were contact details and York IDs, but some forms held far more sensitive answers.
York University in Toronto says an unauthorized person got into online forms that its departments used for everyday business, such as meeting registrations, residence applications and surveys, and stole personal information from some of them. The university found the intrusion on October 25, 2026 and has now posted a public notice and FAQ listing which departments’ forms were involved and what kinds of data were taken. The affected forms reach back as far as 2007.
What happened
York says it learned of the incident on October 25, contained it quickly and investigated with outside experts. It says the investigation found no evidence that the intruder moved beyond the affected systems into other parts of the university’s IT environment. A York spokesperson told CBC News that the forms were not tied to York’s main systems, such as applications, human resources or student records, and that “responsive security improvements” have been made to the departmental web forms.
York has reported the breach to the Information and Privacy Commissioner of Ontario and to law enforcement. It has not said how many people are affected, how the intruder got in, or when the access began. BleepingComputer found no ransomware group claiming the attack at the time of its report.
What was taken
York’s FAQ lists the stolen data by department, for groups of people rather than individuals. Departments named include the Centre for Refugee Studies, the Faculty of Graduate Studies, the Faculty of Liberal Arts and Professional Studies, the Faculty of Environmental and Urban Change, Housing and Conference Services, the Lassonde School of Engineering and the Schulich School of Business.
York stresses that the list is the full set of fields across each department’s forms, not what was taken about every person, and that most stolen information was basic: York identification numbers and contact details. Depending on the form, though, the fields include:
- name, email address, phone number and street address
- date of birth, gender, citizenship or origin
- academic and employment history
- family or third-party contact details
- disability or accommodation status, diet and allergy details, and health information
- financial status, legal or criminal background answers, and for some forms race or ethnicity, religion, sexual orientation, Indigenous status, photos or vaccination status
York says “legal or criminal background” may simply mean a form recorded that someone had no record. A small number of additional people had government ID or financial account information exposed. York is notifying them directly by email and offering two years of TransUnion credit monitoring and identity theft protection.
What this means for you
If you filled in a York departmental form at any point since 2007, your contact details and York ID may be in the stolen set. The most likely misuse is targeted phishing: messages that mention a real residence application, event or program to sound believable. For people whose forms included health, disability or immigration-related answers, the information is personal even if it can’t be used to open accounts.
What you can do
- Check York’s FAQ to see whether a department you dealt with is listed. If you’re unsure what was taken about you, York says you can contact the university to ask.
- Be wary of messages about York. York says it will never call, text or email you to ask for passwords, banking details or full card numbers. If you get such a request, don’t reply; contact York using details from yorku.ca that you type in yourself.
- If York emails you about credit monitoring, enroll using the code in the letter, and check the TransUnion offer from TransUnion’s own site rather than a link in a forwarded message.
- Use strong, unique passwords and multi-factor authentication on your York and personal accounts, as York recommends, and watch your bank and card statements.
- Read what to do after a data breach in Canada for a short checklist, including how to complain to a privacy commissioner.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.
Related coverage
- Canadian Mennonite University breach exposed SINs on a decade of tax slips: another Canadian university breach this fall, where old records also turned out to be in scope.
- Burnaby School District ransomware: what families should know: a Canadian education breach with student and staff information.
Sources
- York University, Cybersecurity Incident: information and FAQ, November 2026
- CBC News, York University warns of personal data theft in cybersecurity incident, November 2026
- BleepingComputer, York University breach exposed personal information dating to 2007, November 2026
More stories
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.