Overview
- York discovered an unauthorized access on October 25, 2026 and found that an actor had stolen data from departmental online forms dating back to 2007 through October 2026.
- The breach was limited to specific departmental websites and not to core systems such as admissions, human resources or central student records, according to the university.
- Stolen fields varied by form and included contact details, York ID numbers, academic and health information, photos and, for a small number of people, government ID and financial account information.
- York engaged outside cybersecurity experts, secured the affected forms, directly notified impacted individuals, and offered two years of TransUnion credit monitoring to those whose government or financial data were exposed.
- The university has reported the incident to police and the Information and Privacy Commissioner of Ontario, which is expected to investigate privacy impacts and whether the response met legal requirements while the community is urged to watch for phishing and monitor accounts.