York University breach: threat actor stole personal info from online forms (2007–2026)
Severity: medium · Patch status: no-fix-needed · Since 2026-11-09
York University in Toronto confirmed a cybersecurity incident in which an unauthorized actor accessed limited online forms used by university departments. Discovered on October 25, 2026, the breach affected form submissions on 14 university websites between 2007 and 2026. Stolen data varies by person but includes email addresses, phone numbers, dates of birth, York ID numbers, and for some individuals government ID information, health information, academic and employment history, financial status, criminal background, demographic details, and images. Most records contained basic contact info and York IDs. The university says the forms are now secure, will directly notify those whose government ID or financial data was exposed, and is offering two years of credit monitoring and identity theft protection. No victim count or perpetrator details have been disclosed, and no ransomware group has claimed the attack.
What to do
- If you submitted forms to York University since 2007, watch for phishing and social engineering attempts using your contact details
- Enroll in the offered credit monitoring and identity theft protection if notified
- Contact York University to confirm what specific data about you was exposed
- Monitor financial accounts and credit reports for suspicious activity
- Organizations running web form intake: review access controls and retention of long-lived form data
Sources
All live incidents on Threat Watch
