York University Confirms Breach Exposing Personal Information Dating to 2007
Summary
York University confirmed an attacker accessed forms on 14 university websites, exposing personal information submitted between 2007 and 2026. The university has not said how many people were affected or identified the perpetrator.
Key points
- The university discovered the unauthorized access on October 25 and confirmed that personal information was stolen.
- Affected forms were submitted through 14 university websites between 2007 and 2026.
- Exposed information varied by person and included contact details, York ID numbers, and potentially government ID, health, academic, employment, financial, and other sensitive information.
- York said most stolen records contained basic contact information and York ID numbers.
- The university said the forms are secure and will directly notify people whose government ID or financial account information was exposed.
- Affected individuals will be offered two years of credit monitoring and identity theft protection; the number of people affected is unknown.
- No perpetrator has been identified, and the article reports no ransomware-group claim.
Article Details
- Victim Organization
- York University
- Incident Type
- Unauthorized access to online forms and theft of personal information
- Disclosure Date
- 2026-11-06
- Data Types Exposed
- Email addresses
- Phone numbers
- Dates of birth
- York identification numbers
- Government ID information
- Third-party contact information
- Health information
- Academic history
- Employment history
- Financial status
- Criminal background
- Demographic details
- Photos and other images
- Affected Records
- Not disclosed
- Operational Impact
- York University said it acted quickly to contain the incident and that the affected website forms are now secure. No service disruption was reported.
- Ransom Or Extortion
- No ransomware group was reported to have claimed the attack; no other ransom or extortion activity was reported.
- Claim Status
- confirmed