York University breach exposes years of webform submissions

York University confirmed that an unauthorised person stole personal information submitted through online forms used by 14 academic departments and housing offices. The university detected the intrusion on 25 October 2026 and isolated the affected webform platform. The compromised submissions date from 2007 to October 2026 and came from students, staff and visitors. York has not given a total number of affected records, and said that not every person had every listed type of information taken.

The stolen data varies by form. It includes names and contact details, York identification numbers, academic and employment histories, dates of birth, citizenship, disability accommodations and vaccination status. Some forms also contained information about race, religion or Indigenous status; a smaller number included government identification or financial account details. York said external forensic investigators found no evidence the intruder accessed the university’s wider IT network. The technical vulnerability that enabled access remains under investigation.

York contained the incident, hired external investigators, reported it to law enforcement and Ontario’s Information and Privacy Commissioner, and deployed security updates to its webforms. The university is contacting a small group of people whose government ID or financial account details were exposed; they are to receive two years of complimentary TransUnion credit monitoring. It said verifying individual enquiries may take time because of the size of the affected population.