York University Says Someone Took Personal Information Submitted Through Online Forms on 14 of Its Websites, Going Back to 2007. If You Ever Filled One In, Here Is What York Says and Has Not Said
If you ever applied, enrolled, asked about housing, or sent a form to a York University department in Toronto, expect the data you gave may have been taken, and watch for phishing that uses it. York says an unauthorized actor accessed online forms on 14 departmental websites and took the personal information people had submitted through them. The oldest of those forms started collecting in 2007. York found out on October 25, 2026.
What has been reported
The primary source is York's incident FAQ, which we had read for us. BleepingComputer's report of November 9 matches it. York gives no attacker, no count of people, and no date of publication in the page text we saw.
Which sites: 14 departmental web forms, each with its own start year: Centre for Refugee Studies (2019), Department of Psychology (2016), Division of Students (2019), Faculty of Environmental and Urban Change (2007), Faculty of Graduate Studies (2013), Faculty of Liberal Arts and Professional Studies (2013), Faculty of Science (2014), Glendon Housing (2017), Housing and Conference Services (2015), Lassonde School of Engineering (2020), Research and Innovation (2018), Schulich School of Business (2016), University Secretariat (2015) and the Vice-Provost Academic (2022). The exposure runs from each site's start year until October 2026.
What data: it depends on the form. York's list includes contact details, dates of birth, York ID numbers, academic history, employment history, health information, disability and accommodation status, citizenship, vaccination status, race, religion, sexual orientation, Indigenous status, legal or criminal background, financial status, family contacts and photos. York says "most stolen information was basic information such as York identification numbers and contact information."
Higher-risk subset: for "a small number" of people, government ID or financial account information was involved. York says it will email them directly and offer two years of TransUnion credit monitoring.
Notification: York says its FAQ "serves as York's notification" for everyone else. It has told Ontario's Information and Privacy Commissioner and law enforcement.
Cause: York says only that it is still investigating and has made "responsive security improvements" to the web forms. No ransomware group has claimed the attack, per BleepingComputer.
What it means
The detail that matters is the date range, not the attack. A form built in 2007 and never retired was still holding what people typed into it nineteen years later. The data most people expect a university to protect, such as health, accommodation and student records, sat in simple web-form storage on departmental sites. We do not know how the attacker got in, and York does not say.
What to do
If you have any link to York (applicant, student, staff, housing, conference guest), assume your contact details and ID number may be taken. Expect phishing that quotes real details, and do not act on email, text or calls that you did not start. York says it will never call, text or email to ask for a password or banking details.
Use a unique password and multi-factor authentication on your York account and on any account that shares the password.
Watch your accounts and your credit file. If you gave government ID or financial details on a York form, contact York at the address on its FAQ.
If you run a university or any organisation: list every web form that collects personal data, find the oldest one still live, and ask who reads the data and whether it needs to be kept. Delete what you do not need. A form you have forgotten is a database you have not secured.
Make sensitive form submissions leave the web server quickly, to a system with its own access control, rather than staying in a database on the same host as the page.
Keep an inventory of departmental sites. Central IT usually cannot protect what it does not know exists.
What is not known
How many people are affected. How the attacker got in. Who the attacker is. Whether the data is being offered or used. Whether other universities use the same form software, because York does not name it. We add no indicators to our feed: none are published.
How we know, and how we checked
We read York's incident FAQ (through an agent that fetched it) and BleepingComputer's report of November 9, which we did not open ourselves. Every detail above is York's own account. A search of our corpus found no earlier post of ours on York University.
Sources
York University, incident FAQ, information security pages, read November 10, 2026. BleepingComputer, "York University breach exposed personal information dating to 2007," November 9, 2026.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments