York University says web-form breach exposed sensitive personal data

York University said an unauthorized actor stole personal information from a limited set of departmental web forms containing submissions dating from 2007 through October 2026. Most affected information was basic data such as York identification numbers and contact details, but the categories varied by form and could include academic and employment history, citizenship, financial status, health, disability, demographic and legal-background information. A smaller group had government identification or financial account information exposed.

The university said the incident came to its attention on October 25 and was contained. Its investigation found no evidence that the actor moved beyond the affected web-form systems into other parts of York's technology environment. York is notifying affected people, offering two years of credit monitoring to eligible individuals and has reported the breach to Ontario's privacy commissioner and law enforcement. It has not disclosed an affected-person count or identified the attacker.