York University says it was subject to a cybersecurity incident in which an unauthorised actor accessed limited online forms used by university departments, and confirms the theft of personal information from some departmental forms.

It says the incident came to its attention on 25 October 2026, it contained it and investigated with external experts, has no evidence the actor moved beyond the affected systems, and has reported the breach to the Information and Privacy Commissioner of Ontario and to law enforcement. Affected people completed online forms on listed York websites from the year shown for each (the earliest is 2007) to October 2026; data stolen varies by group and includes items such as York ID numbers, contact details, dates of birth, academic and employment history, and for some groups health, financial status, legal or criminal background and demographic information.

York says most stolen information was basic, such as York ID numbers and contact information. It is notifying affected individuals, and a small number whose government ID or financial account information was exposed will get two years of TransUnion credit monitoring and identity theft protection. (source: York University)

According to BleepingComputer, forms on 14 university websites were affected, York has not said how many people were impacted, and no ransomware group had claimed the attack at the time of writing. (source: BleepingComputer)