York University says personal data was stolen from departmental webforms

York University says an unauthorized actor stole personal information from limited departmental webforms; York says affected information varies by person and most stolen information was basic identification and contact information.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

Four blank webform cards float beside a cracked shield, with teal data lines leading toward a glowing containment barrier beside a generic university-style building.
AI-generated editorial illustration of York University’s contained departmental-webforms data theft; not an official York University image or real interface.

York University says personal data was stolen from departmental webforms

York University says an unauthorized actor accessed limited departmental webforms and took personal information submitted through them.1 The university says it discovered the incident on October 25, 2026, contained it, and began an investigation with external experts.1

York says it contained the incident.1 • Reporting cutoff: November 8, 2026, 10:01:07 PM EST / 2026-11-09T03:01:07Z

The bottom line

The affected forms served 14 named York websites or organizational units, with listed collection periods beginning between 2007 and 2022 and extending to October 2026.1 York warns that its table lists data types for populations, not a complete set stolen from every person.1

Verified facts

DiscoveryYork says the incident came to its attention on October 25, 2026.1
Scope boundaryYork says its investigation found no evidence that the actor moved beyond the affected systems or accessed other parts of its IT environment.1
NotificationsYork says the public notice serves as notification for people in the listed groups and time periods; it will directly notify a small additional group.1

What happened

Across the affected populations, York lists fields that can include contact and York identification information, academic and employment histories, dates of birth, health and accommodation information, financial status, images, and demographic information.1 The university says the information affected varies person by person and that most stolen information was basic information such as York identification numbers and contact information.1

Why it matters

York says a small number of additional affected individuals will receive direct email notifications.1 Within that group, people whose government identification information or financial account information was exposed will receive two years of complimentary TransUnion credit monitoring and identity theft protection.1

What this means for readers

  • Remain alert for suspicious emails, text messages and calls, especially requests for personal information or directions to unfamiliar websites.1
  • Monitor financial accounts for unusual activity, and use strong, unique passwords plus multi-factor authentication where available.1
  • People who want to learn which specific information types about them were affected can contact York at incident@yorku.ca; York says it will verify identity before reviewing the affected information.1
  • York says suspicious activity should be reported promptly to the relevant financial institution or service provider; suspected fraud can also be reported to the Canadian Anti-Fraud Centre and York.1

Reporting and response

York says it reported the privacy breach to the Information and Privacy Commissioner of Ontario and reported the incident to law enforcement.1 It also says responsive security improvements were implemented for its webforms while the cause remains under investigation.1

What remains unknown

CBC reported that York did not disclose when the incident first took place or how long after discovery it found the theft.2 York says the cause remains under investigation.1

The statement that no movement into other university systems was found is York’s reported investigation result; it is not a guarantee that no other activity occurred.1

Sources

  1. York University Cybersecurity Incident FAQ — official incident notice and FAQ, accessed November 8, 2026, 10:01:07 PM EST.
  2. York University warns of personal data theft in cybersecurity incident — CBC News, posted November 8, 2026; accessed November 8, 2026, 10:01:07 PM EST.

Update and correction note: This article reports the sources available at the stated cutoff. It does not promise future updates.

Browse Articles

Latest Articles