Overview
York University in Toronto has confirmed that a threat actor breached its systems and stole personal information that people submitted through online forms. The university discovered the unauthorized access on October 25 and disclosed it publicly in early November 2026.
Scope
Forms submitted on 14 university websites between 2007 and 2026 were affected. York has not said how many people are impacted. The data varies by person, but most records contained basic contact details and York ID numbers.
Categories of data that may have been exposed include:
- Email, phone number, and date of birth
- York ID number and government ID information
- Third-party contact information
- Health, academic, and employment history
- Financial status and criminal background information
- Demographic details and photos or images
University Response
York says it contained the incident and that the affected website forms are now secure. The university said: "we regret to confirm the theft of personal information from some departmental forms."
- People whose government ID or financial account information was exposed will be notified directly.
- Those individuals get two years of credit monitoring and identity theft protection.
- Anyone who was not notified can contact the university to find out what data of theirs was involved.
No ransomware group had claimed the attack at the time of reporting, and the perpetrator has not been identified.
Risk and Recommendations
Contact details combined with sensitive fields raise the risk of phishing and social engineering.
- Treat unsolicited messages referencing York or your student record with suspicion.
- Enroll in the offered credit monitoring if you are notified.
- Organizations should audit long-lived web forms: retain only what is needed, purge old submissions, and avoid collecting government ID through general-purpose forms.