York University

York University Breach Exposes Personal Information Submitted Since 2007

York University in Toronto has confirmed a cybersecurity incident where an unauthorized actor accessed personal information from online forms on 14 university websites. The breach, discovered on October 25, affected data submitted between 2007 and 2026. Exposed information includes email addresses, phone numbers, dates of birth, York identification numbers, government ID information, health information, academic history, and more. The university has secured the forms and will notify affected individuals whose sensitive data like government IDs or financial information was exposed, offering two years of credit monitoring. No details on the number of victims or perpetrators have been released, and no ransomware groups have claimed responsibility. This incident highlights risks of phishing and social engineering due to the combination of contact and sensitive data.