York University in Toronto has confirmed that an attacker broke into some of the online forms its departments use and stole personal information people had typed into them. The affected forms were spread across 14 university websites, and on some of them the stolen submissions go back as far as 2007.
What happened
According to the university, the unauthorized access came to light on October 25, 2026. York says it moved quickly to contain the intrusion and brought in outside experts to investigate and clean up the affected systems. In a public notice first posted on November 6, it confirmed that personal information had been taken from some departmental web forms.
These forms were used for everyday university business, such as meeting and event registrations, residence applications and general surveys. York says its investigation found no sign that the intruder moved beyond those systems into the rest of its IT environment, and that the forms are now safe to use again.
The university has reported the breach to the Information and Privacy Commissioner of Ontario and to law enforcement. It has not said how the attacker got in or who was responsible, and BleepingComputer reported that no ransomware group had claimed the attack at the time of its story.
Who's affected
Anyone who filled in a form on one of the affected sites during the listed period, up to October 2026, could be affected. The sites include the Centre for Refugee Studies, the Department of Psychology, the Division of Students, the Faculty of Graduate Studies, the Faculty of Science, Glendon Housing, Housing and Conference Services, the Lassonde School of Engineering, Research and Innovation, the Schulich School of Business, the University Secretariat and the Vice-Provost Academic office, among others. The oldest records, from 2007, come from forms run by the Faculty of Environmental and Urban Change.
York has not said how many people are affected. It's a big community: the university has more than 55,000 students and about 7,000 administrative staff, and the exposure also reaches former students, applicants and visitors who used the forms over the years.
What data was taken
York published a detailed list of the data types stolen from each website. It stresses that the list covers each group as a whole, not every individual, and that most of the stolen records held basic details like contact information and York ID numbers. Depending on the form, though, the exposed information can include:
- Names, email addresses, phone numbers and street addresses
- Dates of birth and York identification numbers
- Family or third-party contact details
- Academic and employment history
- Financial status, such as income and debts
- Health information, disability or accommodation status, diet and allergy details, and vaccination status
- Citizenship, race or ethnicity, Indigenous status, religion, gender and sexual orientation
- Legal or criminal background answers
- Photos and other images
A smaller group of people had government ID or financial account information exposed. York says it will contact them directly by email and offer two years of free TransUnion credit monitoring and identity theft protection.
Why it matters
Web forms often get less attention than core student or finance systems, yet they can quietly collect very sensitive information for years. In this case, submissions from almost two decades ago were still stored and reachable. For the people involved, the bigger near-term risk is targeted phishing: a scammer who knows your name, York ID, program and phone number can write a very convincing message.
What you should do
- If you've used York University web forms since 2007, check the university's incident page to see whether a site you used is on the list. Questions can go to incident@yorku.ca.
- Be wary of emails, texts or calls claiming to be from York, especially ones that ask for passwords, banking details or other personal information, or that send you to unfamiliar websites. York says it will never ask for these.
- If you get a notification offering credit monitoring, sign up for it, and keep an eye on your bank and credit card statements.
- Use strong, unique passwords and turn on multi-factor authentication wherever you can.
- For organizations: review old web forms, delete submissions you no longer need, and make sure form data isn't stored somewhere that's easy to reach.
0 Comments