York University says an unauthorized actor stole personal information from departmental online forms used across the Toronto campus, and it is notifying affected community members.
In its official incident FAQ, York said the actor accessed a limited set of web forms used by university departments. The school said it acted quickly to contain the incident after discovering it on October 25, 2026, but confirmed that personal information from some of those forms was taken.
The forms supported day-to-day university business such as meeting registrations, residence applications, and general surveys. York said the investigation found no evidence the actor moved beyond the affected systems into other parts of the university’s IT environment. Primary systems such as applications, human resources, and core student systems were not implicated, according to university statements reported with the notice.
Which forms and what data
York published a department-by-department list covering forms used from as early as 2007 through October 2026. Affected units include the Centre for Refugee Studies, the Department of Psychology, several faculties, housing services, Lassonde School of Engineering, Schulich School of Business, and others.
Stolen data types vary by form and by person. York said most of what was taken was basic information such as York identification numbers and contact details. The published list also includes, for some populations, academic history, citizenship or origin, disability or accommodation status, financial status, health information, Indigenous status, race or ethnicity, religion, sexual orientation, government identification, and financial account information, among other fields. York stressed that the full list does not apply to every affected person.
A small additional group is being notified directly. People in that group whose government identification or financial account information was exposed will receive two years of complimentary TransUnion credit monitoring and identity theft protection.
What York has done
York contained the incident, brought in outside experts, reported the privacy breach to the Information and Privacy Commissioner of Ontario, and reported the incident to law enforcement. It said it has added responsive security improvements to its web forms while the review continues.
Affected people were told to watch for suspicious emails, texts, and calls, monitor financial accounts, and use strong unique passwords with multi-factor authentication where available. Questions can go to incident@yorku.ca.
Education-sector breaches that touch student and staff records have been a steady theme this year, including the Harvard alumni and donor exposure and the Florida Department of Education financial aid website breach.
