York University in Toronto has confirmed that an unauthorized actor accessed personal information submitted through online forms used by university departments. The intrusion was discovered on October 25 and affected forms submitted on 14 university websites between 2007 and 2026.
York serves more than 55,700 students across 200 undergraduate and graduate programs and employs an administrative staff of about 7,000. In its announcement, the university said it acted quickly to contain the incident after discovery but confirmed that personal information from some departmental forms was stolen.
Categories of exposed data
According to the university, the attacker obtained some or all of the following categories of information, though the specific data varies by individual:
- Email address and phone number
- Date of birth and York identification number
- Government ID information
- Third-party contact information
- Health information
- Academic and employment history
- Financial status and criminal background
- Demographic details and photos
Most stolen records reportedly contained basic contact details and York ID numbers. Even so, pairing contact information with other sensitive fields materially raises the risk of phishing and social engineering against affected people, so recipients should treat unsolicited messages referencing York with added caution.
Response and notification
York said the affected website forms are now secure. It will directly notify individuals whose government ID or financial account information was exposed and is offering two years of credit monitoring and identity theft protection. Anyone who did not receive a notice can contact the university to learn which data types were involved in their case. The university has not disclosed how many people were affected.
Attribution status
No details about the perpetrators have been released. At the time of reporting, BleepingComputer had not identified any ransomware group claiming responsibility for the attack.
