"York was recently subject to a cybersecurity incident involving an unauthorized actor accessing limited online forms used by University departments," the university stated on Friday.
Discovery, scope, and timeline
The university discovered the unauthorized access on October 25 and confirmed that the breach affected online forms hosted across 14 York University websites. The forms contained entries submitted over nearly two decades — from 2007 through 2026 — according to the university announcement. York described the incident as involving "limited online forms used by University departments" and said it acted quickly to contain the intrusion after discovery.
Types of personal information accessed
York published a detailed list of the categories of information the intruder accessed. Across the affected forms the attacker obtained, in whole or in part, one or more of the following:
- Email address
- Phone number
- Date of birth
- York identification number
- Government ID information
- Third-party contact information
- Health information
- Academic history
- Employment history
- Financial status
- Criminal background
- Demographic details
- Photos and other images
The university said the exact data types accessed vary by person, and that most stolen records contained basic contact information and York ID numbers.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleResponse by York University and protections offered
York said the website forms are now secure and safe to use. The university pledged to directly notify individuals whose government ID or financial account information was exposed and to offer those people two years of credit monitoring and identity theft protection coverage. The announcement also advises that individuals who did not receive a notification may contact the university directly to learn what specific types of data were exposed in their case.
What this means for students, staff, and third-party contacts
- Students and staff: Many people at the university — which the announcement describes as a major Toronto institution with more than 55,700 students across 200 undergraduate and graduate degree programs and an administrative staff of 7,000 — should monitor communications from York for direct notifications. Those who are notified that their government ID or financial account information was exposed will be offered two years of identity protections.
- University IT and departmental administrators: The university has stated the affected forms are now secure and that containment actions followed discovery on October 25. Departments that operate online forms will likely need to verify their forms and notification workflows to ensure any remaining risks are addressed and that affected individuals are reached.
- Third-party contacts named in forms: The university confirmed that "third-party contact information" was among the data categories accessed. Individuals outside the university who were named or listed in departmental forms should expect possible notification or outreach and should take standard precautions if contacted about account or identity verification.
Attribution, impact, and open points
York has not specified how many individuals were impacted. The university did not name a perpetrator, and at the time of reporting BleepingComputer did not find any ransomware group claiming the attack. The university characterized the breach as the theft of personal information from some departmental forms and framed the exposure as limited to those online submissions.
The university also warned — in the same announcement that cataloged the exposed fields — that exposing contact information alongside other sensitive data "significantly increases the risk of phishing and social engineering attacks for affected individuals." That explicit warning points to the immediate, practical risk for anyone whose contact details and personal identifiers were accessed.
York's next concrete steps, per its announcement, are to notify directly individuals whose government ID or financial account information was exposed and to provide the two-year identity protection service to those people. Beyond these commitments, the university has not released a count of affected records, nor has it provided technical details about how the forms were accessed.
For more details, see the original report on BleepingComputer: https://www.bleepingcomputer.com/news/security/york-university-breach-exposed-personal-information-dating-to-2007/
