York University breach: personal information stolen from departmental web forms dating back to 2007, including government ID and health information for some
York University confirms an attacker stole personal information from departmental web forms dating back to 2007, including government ID for some people.
What happened
York University, in Toronto, Canada, says an unauthorised actor accessed limited online forms used by its departments and stole personal information submitted through them. The incident came to the university’s attention on October 25, 2026. York says it contained the incident, brought in external experts to investigate, and has implemented security improvements to its web forms; its investigation found no evidence that the actor moved beyond the affected systems or reached other parts of the university’s IT environment. York has reported the breach to the Information and Privacy Commissioner of Ontario and to law enforcement. The university says the cause is still under investigation — it has not said how the actor got in, or when the access began.
Who is affected
People who completed online forms on 14 York University websites — among them the Department of Psychology, the Division of Students, the Faculty of Graduate Studies, the Faculty of Science, the Lassonde School of Engineering and the Schulich School of Business. The forms covered meeting registrations, residence applications, surveys and other university business, and the affected submission periods run from a start year between 2007 and 2022, depending on the site, through October 2026. What was stolen varies by person: York says most stolen information was basic, such as York identification numbers and contact information. Across the affected groups, the university’s list also includes email addresses, phone numbers, dates of birth, street addresses, academic and employment history, health information (which may include diagnosis and treatment), disability and accommodation status, financial status (which may include income and debts), legal and criminal background information, demographic details and photos. A smaller group whose government identification information or financial account information was exposed will be notified directly by email. York has not disclosed how many people are affected in total.
How serious
For the smaller group whose government identification or financial account information was taken, the concrete risk is identity fraud — that is the group York is offering two years of TransUnion credit monitoring and identity theft protection. For everyone else, the main risk is targeted phishing and impersonation: an attacker holding a person’s real contact details, York ID number and the knowledge of which university services they used can write messages that quote true facts and pass a casual check. Some groups face a further risk: forms for the Centre for Refugee Studies and several faculties included health, disability, citizenship and demographic details, and stolen information of that kind can be used for extortion or for scams built around a person’s circumstances. York stresses that most records held only basic contact and ID information — but basic contact details are exactly what a convincing phishing message needs.
What to do now
Check York’s incident notice (linked below): its table lists the affected websites and the years each covers, and for people in those groups and periods the notice itself serves as the notification. To learn exactly which types of your information were taken, contact York at incident@yorku.ca — the university will verify your identity first, and it warns replies may take time. If you receive a direct email offering the credit monitoring, enrol in it. Monitor your financial accounts for unusual activity, and use strong, unique passwords with multi-factor authentication where available. Treat unexpected calls, texts and emails claiming to come from York with care: York says it will never call, text or email you to ask for passwords, a social insurance or social security number, banking details or full credit card numbers — hang up and do not reply. If you spot suspected fraud, report it to the Canadian Anti-Fraud Centre and to York.
Sources: York University, “Cybersecurity Incident” notice and FAQ, November 2026 · BleepingComputer, “York University breach exposed personal information dating to 2007,” November 9, 2026 · CyberInsider, “York University data breach exposes student personal information,” November 9, 2026