AI-generated illustration; not a photograph of the reported event.
- calendar_today November 8, 2026
York University Discloses Data Theft from Online Departmental Forms
York University has informed students, faculty, and staff about a recent cybersecurity incident that resulted in the theft of personal information. The university announced that an unauthorized actor accessed online forms used by various departments, compromising data such as personal contact information and student identification numbers.
Discovery and Scope of the Incident
The Toronto university became aware of the incident on October 25, 2026. According to a statement posted on the university’s website, online forms spanning from 2007 through October 2026 were targeted. These forms were used for a range of university activities, including residence applications and general surveys.
After discovery, York University took immediate measures to contain the breach. However, it has not revealed the precise duration of unauthorized access or when the data theft first occurred.
Types of Information Stolen
The compromised data includes a range of sensitive personal details:
- Personal contact details and student identification numbers
- Academic history
- Citizenship information
- Disability and accommodation statuses
- Email addresses and phone numbers
- Family contact information
- Financial information
Several departments were impacted, including the Centre for Refugee Studies, the Department of Psychology, and the Faculty of Graduate Studies. York University has published a full list of affected departments and data types on its website.
Response and Support for Those Affected
York University is in the process of directly contacting individuals whose financial and government identification data were exposed. Those affected will receive two years of TransUnion credit monitoring and identity theft protection. The university is advising everyone in the community to monitor financial accounts for unusual activity and to be cautious of suspicious emails, text messages, or phone calls.
The university recommends using strong passwords and enabling multi-factor authentication to enhance data protection. Any suspicious activity should be reported promptly to financial institutions, service providers, or the Canadian Anti-Fraud Centre and the university itself.
Investigation and Ongoing Measures
After detecting the incident, York University engaged external experts to investigate and secure impacted systems. The investigation did not uncover evidence that other university information or systems were affected. The incident has been reported to law enforcement and to the Information and Privacy Commissioner of Ontario, who is expected to open an investigation. Those impacted may also file a complaint with the commissioner.
In its statement, the university acknowledged concerns within the community and expressed regret over the breach. It reiterated its commitment to strengthening cybersecurity protocols, readiness, and safeguards for personal information.
Advice from Experts in the Wake of a Data Breach
York University pointed out that, while most of the stolen information does not inherently pose an elevated risk for identity fraud, the risk for such fraud remains. Cybersecurity specialists recommend several key steps in the aftermath of a data breach, such as monitoring financial accounts, updating passwords, and remaining alert to potential scams. The university has provided online resources to help individuals protect themselves.
Source: cbc.ca.
