York University Investigates Form Breach and Data Theft
Intruder targets departmental web forms spanning nearly two decades, exposing personal records and student data across the Toronto campus.
- By Jesse Jacobs
- November 09, 2026
Hackers compromised departmental web forms used across York University, exposing personal and academic records collected over nearly two decades.
The breach involved unauthorized access to web forms utilized by numerous academic units and student service departments. The affected forms handled routine university operations, including residence applications, meeting registrations and departmental surveys.
Stolen records varied across departments. For most individuals, exposed data consisted of contact information and university identification numbers. Depending on the department and form, compromised fields also included academic histories, dates of birth, emergency contacts, employment backgrounds and accommodation requests.
A smaller subset of individuals had government identification or financial account information exposed. The university is contacting those individuals directly and providing two years of complimentary TransUnion credit monitoring and identity theft protection services.
External cybersecurity specialists assisted the institution with containment and a forensic investigation. Investigators determined the unauthorized party did not expand beyond the affected web forms or compromise other segments of the university IT infrastructure.
According to a report by CityNews Toronto, the university first uncovered the cybersecurity incident on Oct. 25 before publicly detailing the scope of the affected websites and faculties.
The university notified law enforcement authorities alongside the Information and Privacy Commissioner of Ontario. Campus officials advised students and employees to remain vigilant against phishing attempts and report suspicious financial activity to the Canadian Anti-Fraud Centre.