York University investigating cybersecurity incident, data theft - The Spec
York University is investigating a cybersecurity incident that resulted in the theft of personal data discovered last month.
The breach, discovered on Oct. 25, 2026, involved unauthorized access to information from individuals who completed online forms on select university websites, including residence applications and surveys. The affected period spans from 2007 to October 2026.
York University confirmed that a small number of directly affected individuals had their government identification or financial account information exposed. The investigation found no evidence that the unauthorized actor accessed other parts of the university's systems.
Response measures
The university immediately began investigating the breach with the help of external experts. They are offering two years of complimentary TransUnion credit monitoring and identity theft protection to those affected.
Security recommendations
The university is advising affected individuals to remain alert for suspicious communications and monitor their financial accounts. Those directly impacted will be contacted individually.
The incident has been reported to the Information and Privacy Commissioner of Ontario and law enforcement authorities as the investigation continues.
Related
