York University breach exposed personal information dating to 2007

The source has a clear order, so I’ll follow that and check each paragraph stays inside the word and sentence limits.York University in Toronto has confirmed that a threat actor breached its systems and accessed personal information people submitted through online forms, according to BleepingComputer's report. The unauthorized access was discovered on October 25 and affected forms submitted on 14 university websites between 2007 and 2026. Bill Toulas published the account on November 9, 2026, at 04:22 PM.

This piece covers the Friday statement, the data categories named in the announcement, the direct-notice and credit-monitoring offer, and the facts the university has not given. It is for students, staff, applicants, and anyone else who submitted a departmental form on one of those 14 York websites from 2007 through 2026, plus people listed as third-party contacts on those forms. York University said it will directly notify individuals whose government ID or financial account information was exposed.

01October 25 access to departmental forms

York University is a major university based in Toronto, Canada, with more than 55,700 students across 200 undergraduate and graduate degree programs and an administrative staff of 7,000. On Friday it stated that an unauthorized actor had accessed limited online forms used by university departments. The unauthorized access was discovered on October 25, and the affected submissions on 14 university websites run from 2007 to 2026.

"York was recently subject to a cybersecurity incident involving an unauthorized actor accessing limited online forms used by University departments," the university stated. "While York acted quickly to contain the incident following discovery, we regret to confirm the theft of personal information from some departmental forms."

People submitted the stolen details through online forms that university departments used. York said the actor was unauthorized, the forms were limited, and the theft covered some of those departmental forms. Containment followed the October 25 discovery, and the Friday statement is the school's public confirmation of the theft.

02Email, health information, and photos

The announcement lists the exposed data in detail, by category. Across the affected forms, the attacker accessed email address, phone number, date of birth, York identification number, government ID information, and third-party contact information. The same list includes health information, academic history, employment history, financial status, criminal background, demographic details, and photos and other images.

The exact data types exposed vary by person, and most stolen records contained basic contact information and York ID numbers, the university said. Email address and phone number are the contact fields on that category list. Other records reach further into government ID information, health information, financial status, employment history, academic history, or criminal background.

Third-party contact information is its own category, so a stolen form can name a person who did not fill it in. Photos and other images sit on the list beside demographic details and date of birth. York identification numbers appear in most stolen records, alongside that basic contact information.

03Contact data and social engineering risk

Exposing contact information alongside other sensitive data significantly increases the risk of phishing and social engineering attacks for affected individuals. Fields that can appear with an email address or phone number include date of birth, York identification number, government ID information, academic history, employment history, health information, financial status, criminal background, demographic details, and photos. Most stolen records contained basic contact information and York ID numbers, and the exact types still vary by person.

Affected individuals are the people whose information was on the stolen departmental forms. Third-party contact information is a listed category, so the same forms can name a person who did not submit them. A York identification number next to an email address or phone number is the pattern York said showed up in most stolen records.

04Secure forms and two-year monitoring

The announcement says the website forms are now secure and safe to use. York University said it will directly notify individuals whose government ID or financial account information was exposed. With the notice, it will offer two years of credit monitoring and identity theft protection coverage.

Individuals who did not receive a notification may contact the university directly to learn what specific types of data were exposed in their case. York said the exact data types vary by person, and most stolen records contained basic contact information and York ID numbers. Government ID or financial account information is the subset that triggers the direct notice and the two years of coverage.

The category list names financial status among the stolen data. York's notice language names financial account information as the financial reason for a direct notice and two years of coverage. Government ID information is on the stolen-data list and is also a reason York gave for that notice.

05Unstated headcount and no group claim

At this time, the educational institution has not specified how many individuals have been impacted by the cybersecurity incident. York University has more than 55,700 students across 200 undergraduate and graduate degree programs and an administrative staff of 7,000. Those figures describe the Toronto university, and the announcement does not give them as the number of stolen records.

No details have been provided about the perpetrators. At the time of writing, BleepingComputer did not find any ransomware group claiming the attack on the Toronto university. The Friday statement remains the confirmation that personal information was stolen from some departmental forms.