York University says cyberattack stole personal data
Nov 10, 2026 · Summarized by Fundy Tech from 2 sources
York University says an unauthorized actor stole personal information from online forms. The school is warning affected people to watch for suspicious contact and monitor accounts.
Key points
- York says online forms were accessed from 2007 to October this year.
- Stolen data included contact details, student numbers and some financial information.
- The school reported the incident to police and Ontario’s privacy commissioner.
The full story
York University says it discovered last month that it had been subject to a cybersecurity incident involving online forms used by departments from 2007 to October this year. The university said an unauthorized actor gained access to those forms, which were used for a wide variety of university business, including residence applications and general surveys.
The school said it acted quickly to contain the issue after discovering it on Oct. 25, but some personal information was stolen. York did not say when the incident began or how long after discovery the theft continued. It said the affected forms were not tied to its primary systems, such as applications, human resources or student systems.
The stolen data included personal contact details, student identification numbers, academic histories, citizenship, disability and accommodation statuses, email addresses, family contacts, financial information and phone numbers. York said a small number of people had financial account and government identification information exposed, and those people were offered two years of complimentary TransUnion credit monitoring and identity theft protection.
York said it has added responsive security improvements to the web forms and is continuing an investigation with outside experts. It said the investigation did not find evidence that other information or systems were affected. The university has reported the incident to police and to the Information and Privacy Commissioner of Ontario, who is expected to open an investigation.
Why it matters
Students, staff and families should treat unexpected emails, texts and calls carefully after a data breach. If your information was in a form, watch for fraud and use strong passwords and multi-factor authentication. The school says some people are getting credit monitoring.
Who’s affected: York University community members
What’s next
The Information and Privacy Commissioner of Ontario is expected to open an investigation.
What to do
- Watch for suspicious emails, texts and calls.
- Monitor financial accounts for unusual activity.
- Use strong passwords and multi-factor authentication.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.