York University has disclosed a cybersecurity incident in which an unauthorized actor stole personal information from departmental online forms.
The university discovered the incident on October 25, 2026, and brought in external experts to investigate and help secure the affected systems. It has not disclosed how many people were affected, how the attacker gained access, or when the unauthorized access began.
York is a Toronto-based teaching and research university with more than 53,500 students enrolled across over 200 undergraduate and graduate degree programs, and a global alumni network of approximately 390,000 people.
According to its incident notice, the theft involves information submitted through forms used for meeting registrations, residence applications, surveys, and other university business. The affected submission periods vary by department, with the earliest stretching from 2007 through October 2026.
Sensitive information among stolen records
York identified affected forms on 14 departmental and faculty websites, including the Department of Psychology, Division of Students, Faculty of Graduate Studies, Faculty of Science, Lassonde School of Engineering, and Schulich School of Business. Housing services, the Centre for Refugee Studies, and other administrative and research units were also affected.
The oldest affected submissions came from the Faculty of Environmental and Urban Change, dating to 2007. Other departments’ affected records date from 2013 to 2022.
Depending on the individual and form, stolen information includes contact details, dates of birth, York identification numbers, academic and employment histories, photographs, and family or third-party contact information.
More sensitive categories include diagnoses and treatment information, disability and accommodation status, income and debts, citizenship or origin, race and ethnicity, Indigenous status, religion, sexual orientation, vaccination status, and legal or criminal background information.
York emphasized that the categories listed for each department do not apply to every affected person. Most stolen information consisted of university identification numbers and contact details.
Notifications and credit monitoring
York says its investigation found no evidence that the attacker accessed other parts of its IT environment. The university has implemented security improvements to its web forms and reported the incident to law enforcement and Ontario’s Information and Privacy Commissioner.
For people covered by the listed groups and submission periods, the public notice serves as notification. York will directly email a smaller group, including individuals whose government identification or financial account information was exposed, offering eligible recipients two years of free TransUnion credit monitoring and identity theft protection.
Affected individuals can contact incident@yorku.ca to learn what information was stolen, subject to identity verification. York warns that responses may take time.
The university advises watching for suspicious emails, texts, and calls, monitoring financial accounts, and using unique passwords and multifactor authentication.
Leave a Reply