Key facts
- York University said the breach was detected on October 25.
- Affected forms covered submissions on 14 university websites from 2007 through October 2026.
- York University confirmed that an unauthorized actor obtained personal information from online forms used by its departments.
- The exposed information differed for each person, and most stolen records included basic contact details and York ID numbers.
York University said someone without authorization obtained personal information from the online forms used by its departments at the Toronto institution, and it detected the breach on October 25.
Submissions on 14 university websites going back to 2007 and running through October 2026 were affected, covering almost twenty years of archived departmental form submissions. The span covers nearly two decades of archived departmental form submissions.
York University said the theft involved personal information from some departmental forms. Not every record held every data type, although basic contact details and York ID numbers appeared in most of the stolen records. The university released a breakdown of the categories of exposed data.
The university is Canada’s third-largest, based in Toronto with more than 55,700 students and 7,000 administrative staff members across 200 undergraduate and graduate degree programs. York University has not given a total number of people affected.
Homeland411 reported that records held by the Department of Psychology, the Division of Students and the Faculty of Science included clinical notes, diagnostic assessments and formal dietary restrictions. Disability accommodation filings and requests for institutional accessibility were contained in forms maintained by the Centre for Refugee Studies and the Vice-Provost Academic. Records tied to disabilities were among the sensitive categories taken.
Homeland411 reported that Graduate Studies and the Schulich School of Business ran portals exposing student financial status, including family income levels, outside job histories and unpaid debts. Emergency contacts for third parties, citizenship documents and legal background check declarations were among the material held, along with York identification numbers issued by York for students and employees, home street addresses and other identifiers. The repositories also contained research surveys and student residence applications along with faculty registration portals and academic accommodation requests.
Homeland411 reported that departments stored submissions in connected database tables without running automated data minimization schedules. That legacy archiving practice created an expansive attack surface as forgotten tables accumulated across academic cycles and became targets for the intruder.
York University said it immediately took the affected form applications offline after detecting the breach. The university brought in outside digital forensics specialists at once to check the breach’s scope and secure perimeter gateways. Investigators said the intruder targeted standalone departmental form handlers, not the university’s primary active directory infrastructure or its centralized enterprise resource systems.
"While York acted quickly to contain the incident following discovery, we regret to confirm the theft of personal information from some departmental forms."
York University, BleepingComputer
York University told its community about the incident only after finishing forensic containment. It said its online forms are safe to use now.
The university will send direct notices to people whose financial account information or government ID the breach exposed and will provide identity theft protection along with two years of credit monitoring. Those direct notices go only to people whose exposure included the most sensitive identifiers, and the university provides the monitoring free of charge to affected individuals. TransUnion Canada is administering the credit monitoring, according to Homeland411’s reporting. Anyone who did not get a notice can contact the university to ask what information categories about them the breach exposed.
The university told Ontario’s Information and Privacy Commissioner about the incident under the province’s Freedom of Information and Protection of Privacy Act, and it gave forensic telemetry to federal and regional law enforcement, including the Canadian Centre for Cyber Security. Homeland411 said provincial privacy reporting obligations became mandatory as a result of the incident.
Homeland411 reported that Ontario’s privacy regulator will examine whether the university broke retention limits by keeping unencrypted form submissions for nearly twenty years. The review concerns rules governing how long organizations may keep personal information. The commissioner regularly reviews public organizations that do not apply reasonable technical protections to archived health information.
No ransomware cartel made an extortion claim in connection with the breach. Homeland411 reported that the exposed data appeared on underground cybercrime channels, with threat intelligence monitors flagging the material on November 11.
Homeland411 reported that threat intelligence specialists are telling form filers going back to 2007 to check credit bureaus and the Have I Been Pwned service. BleepingComputer said that posting contact information together with other sensitive data increases the risk of phishing and social engineering attacks against affected people.
Join the discussion