York University Confirms Theft of Departmental Webform Data Dating to 2007
Summary
York University confirmed that an unauthorized actor stole personal information from departmental webforms across 14 units, with affected submissions dating to 2007. Investigators found no evidence of access to core university servers.
Key points
- The university detected unauthorized access to limited departmental webforms on October 25, 2026, and confirmed theft of form data.
- Affected forms across 14 university units contained submissions dating as far back as 2007; the university has not released a total record count.
- Exposed information varied and included contact details, academic and employment histories, health and demographic information, and, for a small subset, government ID or financial account details.
- External forensic audits found no evidence that the intruder moved into core university servers; investigators are still examining the technical vulnerability.
- The university isolated the affected platform, engaged incident responders, reported the breach to law enforcement and Ontario’s Information and Privacy Commissioner, and deployed security updates.
- The university advised affected community members to watch for targeted phishing and monitor financial activity; a small subset will receive two years of credit monitoring.
Article Details
- Victim Organization
- York University
- Incident Type
- Unauthorized access to departmental webforms and theft of submitted personal information
- Data Types Exposed
- York identification numbers
- street addresses
- phone numbers
- email addresses
- academic histories
- employment histories
- dates of birth
- citizenship information
- disability accommodation information
- vaccination statuses
- race
- religion
- Indigenous status
- health information, potentially including diagnoses and treatment
- financial status information, potentially including income and debts
- government identification details
- financial account details
- Affected Records
- Not disclosed; the university has not released a total record count.
- Operational Impact
- The affected webform platform was isolated after the intrusion was detected. Forensic audits found no evidence that the intruder accessed or moved laterally into the university’s broader IT network or core servers. Security updates were deployed to the webforms.
- Claim Status
- confirmed