York University has confirmed that an unauthorized person stole personal information from a limited number of online forms used by university departments.
The university says it has identified affected community members and is now notifying them. The forms were used for activities including meeting registrations, residence applications and surveys, according to York’s incident notice.
The affected submissions span 2007 through October 2026 and involve forms on websites operated by several departments and faculties. Depending on the form and affected group, the information listed by York includes contact details and York identification numbers, as well as dates of birth, health and disability information, financial status, legal background, photos, race or ethnicity, religion and sexual orientation. The university cautions that this full list does not apply to every affected person.
A smaller group had government-issued identification or financial account information exposed and will receive two years of complimentary TransUnion credit monitoring and identity-theft protection, York said. The university learned of the incident on October 25, 2026, and says its investigation found no evidence the attacker moved beyond the affected forms or accessed other parts of its IT environment. TorontoToday reported that York has not disclosed how many people were affected or whether they were students or staff.
York has reported the incident to the Information and Privacy Commissioner of Ontario and law enforcement. The university says it brought in external experts to investigate and remediate the affected systems, but has not identified the attacker or explained how the forms were accessed.
York says the intruder did not move beyond the affected forms, a narrower scope than the system access described in Abijita’s reports on the Monroe University breach and the Harvard breach.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
