York University in Toronto, Canada, has confirmed that hackers stole personal information collected through online forms used by several university departments. Some of the compromised records date back nearly two decades, potentially affecting former students, employees, and other individuals who interacted with the institution.
The university discovered the unauthorized access on October 25, 2026, and launched an investigation with external cybersecurity specialists. The breach involved forms hosted across 14 university websites, with affected submissions dating from as early as 2007 through October 2026.
The compromised forms supported various administrative and academic activities, including student housing applications, event registrations, surveys, and departmental services. Affected units include the Department of Psychology, Faculty of Science, Faculty of Graduate Studies, Schulich School of Business, and Lassonde School of Engineering.
According to York University, most stolen records contained relatively basic information, such as email addresses, telephone numbers, residential addresses, and university identification numbers. However, some forms collected considerably more sensitive details.
Depending on the department and the information submitted, the exposed records may include dates of birth, academic and employment histories, financial circumstances, health information, disability-related details, and criminal background information. Certain forms also collected photographs and demographic information, including ethnicity, religion, and sexual orientation.
The university emphasized that not every affected individual had all these categories of information exposed. The specific data involved depends on which forms a person completed and when they submitted them.
A smaller group of individuals also had government identification or financial account information compromised. York said it would contact these individuals directly and provide two years of complimentary TransUnion credit monitoring and identity theft protection.
The investigation has found no evidence that the attackers accessed systems beyond the affected online forms. York’s broader IT environment, including its main student, human resources, and admissions systems, was not found to be compromised.
Following the discovery, the university secured the affected forms and introduced additional security measures. Officials said the websites are now safe to use, although investigations into the cause of the intrusion are continuing.
York has reported the incident to law enforcement and the Information and Privacy Commissioner of Ontario. The university has not disclosed how the attackers gained access, when the intrusion began, or how long the unauthorized activity continued before discovery.
The total number of affected individuals also remains unknown. No threat actor has publicly been identified as responsible, and there has been no confirmed ransomware claim associated with the incident.
York is notifying affected individuals and has published information identifying the departments and submission periods involved. People who believe their information was exposed can contact the university to request details about the specific categories of data affected.