York University Data Breach Exposes Years of Departmental Webform Submissions
Do Son 
TL;DR
A recent York University data breach compromised personal records submitted through online forms across 14 academic departments and housing offices. Specifically, an intruder stole entries dating as far back as 2007 during a departmental webforms theft discovered on October 25, 2026. Fortunately, external forensic investigators found no evidence that the attacker accessed the university’s broader IT network.
What was exposed
The stolen data varies widely depending on which online form a community member completed. For the majority of affected individuals, the exposure only involved basic details like York identification numbers, street addresses, phone numbers, and email addresses. However, several departmental forms collected highly sensitive personal and demographic records.
Depending on the department, stolen fields included academic and employment histories, dates of birth, citizenship, disability accommodations, and vaccination statuses. Furthermore, some forms held race, religion, and Indigenous status details. In its official notice, the university explained that “‘Health information’ may include clinical information such as diagnosis and treatment. ‘Financial status information’ may include information about income and debts.” Additionally, a small subset of individuals had their government identification or financial account details exposed.
Confirmed vs. unverified scope
York University confirmed the theft of form data but has not released a total record count. Instead, the administration noted that not every person had every listed data category stolen. Because the affected population is large, officials warned that verifying individual inquiries via email will take time.
How it happened
The departmental webforms theft occurred when an unauthorized actor gained access to limited online forms used for daily university operations. Departments relied on these webforms for meeting registrations, residence applications, and general surveys. In its public statement, the university noted that “While York acted quickly to contain the incident following discovery, we regret to confirm the theft of personal information from some departmental forms.”
Officials detected the intrusion on October 25, 2026, and immediately isolated the affected webform platform. External cybersecurity specialists are still investigating the exact technical vulnerability that allowed the breach. Meanwhile, forensic audits confirmed that the intruder never moved laterally into core university servers.
Who is affected
This York University data breach impacts students, staff, and visitors who submitted online forms across 14 specific university units up to October 2026. The earliest affected records date back to 2007 within the Faculty of Environmental and Urban Change. Other impacted portals include the Faculty of Graduate Studies (from 2013), the Faculty of Liberal Arts and Professional Studies (from 2013), and the Faculty of Science (from 2014).
In addition, the breach hit forms from Housing and Conference Services (2015), the University Secretariat (2015), the Department of Psychology (2016), and the Schulich School of Business (2016). More recent submissions from Glendon Housing (2017), Research and Innovation (2018), the Centre for Refugee Studies (2019), the Division of Students (2019), the Lassonde School of Engineering (2020), and the Vice-Provost Academic (2022) were also compromised.
What affected people should do
Community members who used these forms should watch closely for targeted phishing emails, text messages, and phone calls. Attackers often use stolen university IDs and academic histories to make fraudulent requests look convincing. Moreover, individuals should monitor their bank statements, use unique passwords, and enable multi-factor authentication on all accounts.
While the public notice serves as formal notification for most groups, the university is emailing a small subset of high-risk victims directly. People whose government ID or financial account numbers were stolen will receive two years of complimentary TransUnion credit monitoring. If you spot unauthorized financial activity, contact your bank and the Canadian Anti-Fraud Centre right away.
York University response
After discovering the York University data breach on October 25, 2026, administrators contained the webform servers and hired external incident response experts. Furthermore, the institution reported the privacy breach to law enforcement and the Information and Privacy Commissioner of Ontario (IPC). Engineers have already deployed security updates to harden the university’s webforms against future attacks.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
