Threat watch / Breach
York University: personal data stolen from department web forms dating back to 2007
York University in Toronto confirms that an unauthorized actor accessed online forms used by its departments and stole personal information from some of them. The incident came to its attention on October 25, 2026 and covers forms on 14 university websites, some filled in since 2007. Most stolen records hold York ID numbers and contact details, but some forms also held health, disability, criminal background or financial information. York has not said how many people are affected or how the actor got in.
- Sector
- Education
- Way in
- Not public yet
- Product or vendor
- None named
- How it happened
- Not public yet Checked 9 Nov 2026
- What was stolen
- Personal information from some departmental forms used for meeting registrations, residence applications and surveys. York says most of it was basic information such as York ID numbers and contact details. Depending on the form, it can also include date of birth, street address, government identification, health, disability or accommodation status, vaccination status, academic and employment history, financial status, legal or criminal background, race, religion, sexual orientation, family or third-party contacts and photos.[1][2] Checked 9 Nov 2026
- Who was impacted
- People who filled in forms on 14 York University websites, from the Centre for Refugee Studies to the Schulich School of Business, from the year set out for each site (as early as 2007) to October 2026. York has not given a number. People whose government ID or financial account information was exposed are notified by email and offered two years of TransUnion credit monitoring.[1][2] Checked 9 Nov 2026
- Threat actor
- Not attributed
Timeline
- The incident comes to the university's attention. [1][2]
- York confirms "the theft of personal information from some departmental forms" and says it found no evidence that the actor moved beyond the affected systems. It has secured the forms and is notifying affected people. BleepingComputer found no ransomware group claiming the attack. [1][2]