York University investigating cybersecurity incident, data theft - CP24
York University is investigating a cybersecurity incident discovered last month that resulted in the theft of personal data from online forms completed between 2007 and October 2026.
The school confirmed that an unauthorized actor accessed information from individuals who completed online forms on select websites, including residence applications and surveys. The breach was discovered on October 25, 2026, and was limited to a specific list of websites and faculties, according to the university.
York University stated that a small number of directly affected individuals had their government identification or financial account information exposed. The institution immediately began an investigation with the help of external experts upon discovering the breach.
Response Measures
The university found no evidence that the unauthorized actor accessed other parts of the university's systems beyond the affected websites. Affected individuals will be contacted directly and are being advised to monitor their financial accounts for suspicious activity.
Affected individuals should remain alert for suspicious emails, text messages and telephone calls, particularly communications asking for personal information or directing them to unfamiliar websites.
Support and Reporting
York University is offering two years of complimentary TransUnion credit monitoring and identity theft protection to those whose government or financial information was exposed. The incident has been reported to the Information and Privacy Commissioner of Ontario and law enforcement authorities.
The university acknowledged the concern caused by the incident, stating: 'We recognize that this incident may be concerning to you. We take that seriously and regret these circumstances.'
Related
