York University breach exposes online form data spanning 2007 to 2026

York University in Toronto is investigating a cybersecurity incident in which an unauthorized actor stole personal data from online forms on select university websites. The affected forms collected submissions from 2007 to October 2026 and included residence applications and surveys, according to the school. The breach was discovered on October 25, and a small number of individuals had government identification or financial account information exposed.

The university says the intrusion was limited to a specific list of websites and faculties, which it has posted online, and that investigators found no evidence the actor moved beyond the affected forms into other parts of the institution. External experts were brought in, and the incident has been reported to the Information and Privacy Commissioner of Ontario and to law enforcement. The university has not disclosed when the intrusion itself took place.

The entry point was not a research cluster or a payments system but ordinary web forms, the kind of infrastructure that accumulates quietly for decades. Nineteen years of submissions — residence applications, surveys — flowed through them; when the unauthorized collection began, the university has not said. Affected individuals are being contacted directly and advised to monitor their financial accounts and "remain alert for suspicious emails, text messages and telephone calls, particularly communications asking for personal information."

Those whose government or financial information was exposed are being offered two years of complimentary TransUnion credit monitoring and identity theft protection. In its release the university said it recognized that the incident "may be concerning to you" and that it takes the matter seriously and regrets the circumstances. The response follows the established template — external experts, a regulator, the police, credit monitoring — with the ongoing cost of vigilance assigned to the people whose data was taken.

York discovered the breach on October 25. The affected forms date back to 2007.