York University confirms personal data theft in cyberattack

ASM, Philippine Canadian Inquirer
November 10, 2026

Photo courtesy: Global News

TORONTO, Canada — York University is investigating a cyberattack that resulted in the theft of personal information from several of its departmental websites. Some affected individuals also had government identification or financial account details exposed.

The Toronto university discovered the incident on October 25 and moved quickly to contain it. It has since brought in cybersecurity experts to investigate the breach.

According to York, an unauthorized person gained access to online forms used for university activities. These included residence applications, meeting registrations and surveys.

The affected records date from as early as 2007 through October 2026. However, the university has not disclosed when the unauthorized access began.

What information was stolen?

York said most of the stolen information involved basic personal details, including names, contact information and university identification numbers.

However, some records contained more sensitive information.

Depending on the affected form, the stolen data may have included academic histories, employment details, dates of birth and financial information.

Some records also contained health information, disability-related details and other personal information.

The university stressed that not every affected person had all these details exposed. The information varied depending on the forms they completed.

Meanwhile, a smaller group had government identification or financial account information compromised.

York has not publicly disclosed the total number of people affected.

University offers identity theft protection

York is notifying affected community members about the breach.

Individuals whose government identification or financial account information was exposed will receive direct email notifications.

The university will also provide them with two years of complimentary TransUnion credit monitoring and identity theft protection.

These services are intended to help affected individuals detect suspicious financial activity and possible identity fraud.

However, York has not reported confirmed cases of identity theft resulting from the incident.

Investigation finds no evidence of wider access

York said the breach involved a limited number of departmental online forms rather than its entire computer network.

The university’s investigation has found no evidence that the intruder accessed other parts of its information technology systems.

However, investigators are still examining how the unauthorized access occurred.

York has also introduced security improvements to the affected web forms.

The university reported the incident to the Information and Privacy Commissioner of Ontario and law enforcement authorities.

What affected individuals should do

York is advising people who submitted forms through the affected university websites to review its official cybersecurity notice.

The notice identifies the departments involved and the periods covered by the stolen records.

The university also urged affected individuals to watch for suspicious emails, text messages and phone calls.

People should be particularly cautious of messages requesting personal information or directing them to unfamiliar websites.

Meanwhile, those with financial information potentially exposed should monitor their accounts for unusual transactions.

York also recommends using strong, unique passwords and enabling multi-factor authentication whenever possible.

Individuals who want to know what information about them was affected can contact the university at [email protected]. 

York will verify their identity before reviewing the relevant records.

The university said it will continue investigating the breach and provide further information through its official cybersecurity notice.