For: people who completed online forms (meeting registrations, residence applications, surveys and others) on any of 14 York University (Canada) faculty and department websites from a start year between 2007 and 2022 through October 2026. This article is an explainer based on the university's official notice and does not cover attack steps.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who completed online forms (meeting registrations, residence applications, surveys and others) on any of 14 York University (Canada) faculty and department websites from a start year between 2007 and 2022 through October 2026.
- Confirmed so farSee the table ↓
- Submissions to online forms on 14 sites
- York ID number, contact details, academic and employment history
- Date of birth, gender, citizenship, race and ethnicity, religion, sexual orientation, images
2 more
- Health information, disability, financial status, legal or criminal background, vaccination status
- Government ID and financial account information
- Not yet confirmed
- The number of people affected (not stated)
- The cause (the university says its investigation continues)
- The date of the notice (not shown on the page)
1 more
- The outcome of the IPC's review (the university expects a file to be opened)
- What to do nowSee the steps ↓
- Check the 14 sites and years to decide whether you are in scope
- Ask the university which of your information was taken
- If you receive a credit monitoring offer, enrol following its instructions
3 more
- Be wary of messages that appear to know your form details
- Review your financial accounts, passwords and multi-factor authentication
- If sensitive information may be involved, know the forms misuse can take
- Where to verify (source)All sources ↓
- York University, "Cybersecurity Incident" (official page; checked November 12, 2026)
- Last checked
- As of November 12, 2026
Follow-up plans and what we checked
The university says further information will be posted on its page as appropriate. When we checked on November 12, 2026, the page showed no dated updates.
What people who may be affected should do today
Check the 14 sites and years to decide whether you are in scope
The university says people who completed online forms on the sites in the table below, from the year shown to October 2026, are affected, and that its notice serves as notification. If you remember registering for a meeting, applying for residence, answering a survey or using another form on a faculty or department site, you may be in scope.
Ask the university which of your information was taken
The contact is incident@yorku.ca (official page). The university will first verify your identity and then review the affected information. Responses may take some time because of the number of people involved.
If you receive a credit monitoring offer, enrol following its instructions
People whose government identification or financial account information was exposed receive two years of free credit monitoring and identity theft protection, with the offer sent by email. The university encourages eligible people to enrol, and the instructions are in that message. If you are unsure the message is genuine, check it with the contact on the official page before opening any link (our view).
Be wary of messages that appear to know your form details
The university asks you to stay alert for suspicious emails, texts and calls, especially those asking for personal information or directing you to unfamiliar websites. It says it will never ask for passwords, social security numbers, banking details or full credit card numbers. See What phishing is.
Review your financial accounts, passwords and multi-factor authentication
The university recommends monitoring financial accounts for unusual activity, using strong unique passwords and enabling multi-factor authentication where available. If you notice anything suspicious, contact your financial institution or service provider promptly; suspected fraud can also be reported to the Canadian Anti-Fraud Centre and to the university (official page).
If sensitive information may be involved, know the forms misuse can take
Information such as health, disability, sexual orientation and legal or criminal background cannot be changed like a password. Threats or messages from someone pretending to know these details are possible (what can generally happen). Do not engage, and consult the university contact and the police.
What happened (from York University's notice)
This section is based on the university's official page "Cybersecurity Incident". It is the university's own account and has not been verified by a third party. The page does not show the date of publication.
October 25, 2026
The incident came to the university's attention. It acted quickly to contain it and began an investigation with the assistance of external experts.Investigation
No evidence has been found that the unauthorized actor moved beyond the affected systems or gained access to other parts of the university's IT environment.Reports
The university reported the privacy breach to the Information and Privacy Commissioner of Ontario (IPC) and notified law enforcement. It expects the IPC to open a file.Notice
The university begins notifying affected people. Its page lists the websites and the types of information involved (the date is not shown).
- What happened
- An unauthorized actor accessed limited online forms used by university departments and took personal information submitted through them
- Who is affected
- People who completed online forms on the listed sites from the year shown to October 2026. The forms were used for meeting registrations, residence applications, surveys and more. Not every data type applies to every person, and most stolen information was basic, such as York ID numbers and contact details
- Number of people
- Not stated
- Additional individuals notified directly
- A small number of people will be notified directly. Those whose government identification or financial account information was exposed receive two years of free credit monitoring and identity theft protection (notice by email)
- Cause
- The investigation continues. Responsive security improvements have been made to the web forms pending further consideration
- Reports
- Reported to the IPC of Ontario and to law enforcement
- Contact
- incident@yorku.ca (identity is verified first, then the affected information is reviewed)
The 14 sites and a summary of the stolen information
The year is the start of the period for that site; every period runs to October 2026. The table picks out only the main sensitive items from the official list, as compiled by this site. The full list of items is on the official page, and within a site not every item applies to every person.
| Site | From | Health information | Financial status | Legal or criminal background | Sexual orientation |
|---|---|---|---|---|---|
| Centre for Refugee Studies | 2019 | Not listed | Listed | Listed | Not listed |
| Department of Psychology | 2016 | Listed | Not listed | Not listed | Listed |
| Division of Students | 2019 | Listed | Listed | Listed | Listed |
| Faculty of Environmental and Urban Change | 2007 | Listed | Listed | Listed | Not listed |
| Faculty of Graduate Studies | 2013 | Listed | Listed | Listed | Listed |
| Faculty of Liberal Arts and Professional Studies | 2013 | Listed | Listed | Listed | Listed |
| Faculty of Science | 2014 | Listed | Listed | Not listed | Listed |
| Glendon Housing | 2017 | Listed | Not listed | Not listed | Not listed |
| Housing and Conference Services | 2015 | Not listed | Not listed | Not listed | Not listed |
| Lassonde School of Engineering | 2020 | Listed | Not listed | Not listed | Listed |
| Research and Innovation | 2018 | Not listed | Listed | Not listed | Listed |
| Schulich School of Business | 2016 | Listed | Listed | Listed | Not listed |
| University Secretariat | 2015 | Not listed | Not listed | Not listed | Not listed |
| Vice-Provost Academic | 2022 | Not listed | Not listed | Not listed | Not listed |
"Listed" means the item appears in that site's list of stolen information. Every site lists York ID number, email address, phone number, street address, academic history, employment history and family or third-party contact. The university explains that "health information" may include clinical information such as diagnosis and treatment, that "financial status" may include income and debts, and that "legal or criminal background" may simply indicate that someone has no record or sanction.
What is known and what is not
The state as of November 12, 2026. We will update the status column when more is published.
| Item | Content | Status |
|---|---|---|
| Submissions to online forms on 14 sites | Stolen | Confirmed (the university) |
| York ID number, contact details, academic and employment history | Most of the stolen information | Confirmed (the university) |
| Date of birth, gender, citizenship, race and ethnicity, religion, sexual orientation, images | Included depending on the site | Confirmed (the university) |
| Health information, disability, financial status, legal or criminal background, vaccination status | Included depending on the site | Confirmed (the university) |
| Government ID and financial account information | Exposed for a small number of people, who are notified directly | Confirmed (the university) |
| Spread to other IT systems | No evidence found | Not confirmed (the university) |
| Number of people affected | Not stated | Not stated |
| Cause | Investigation continues | Under investigation |
| Date of the notice | Not shown on the page | Not stated |
| IPC review | A file is expected to be opened | Under investigation |
How to read this: the site tables list possible items, not necessarily yours
The official list shows the information stolen about each group, not a breakdown for any individual. To find out what was taken about you, you need to ask the university. The finding that there is no evidence of spread to other IT systems comes from the university's own investigation, and no third-party verification has been published.
What can happen when form submissions are stolen
The following is what can generally happen, not a statement that any of it has occurred here. What the university says has occurred is limited to "What happened" above.
A York ID number, contact details, an address, and academic or employment history make it possible to craft convincing messages that appear to come from the university. Adding a date of birth or a family contact can make a message that pretends to verify your identity look real. Sensitive information such as health, disability, sexual orientation and legal or criminal background cannot be changed and can be used for threats or harassment. Where government identification or financial account information is involved, misuse such as opening accounts or applying for credit is a concern. The university says that most of the stolen information is not the type associated with an elevated risk of identity fraud.
What universities and other operators should review
This section does not assess the university's response and does not speculate about technical details. The cause has not been published, so it is limited to what follows from the disclosed facts, as our view.
Do not keep old submissions for long
The earliest start year is 2007, so up to about twenty years of submissions are in scope (our view). Set a retention period for each form, and delete submissions once the purpose is finished, or keep only aggregates.
Do not collect sensitive fields you do not need
The forms served many purposes, such as meeting registrations and residence applications, and some sites collected health, financial, legal or criminal and sexual orientation items. Review for each form whether that is really needed for its purpose, and remove fields that are not. Data you do not collect cannot be stolen (our view).
Take an inventory of departmental forms
The scope here was spread over 14 faculty and department sites. Forms run in a distributed way make owners and storage locations hard to see. Record which department runs which form and where it is stored (our view).
Separate where forms are stored from other environments
The university says it found no evidence of spread to other IT systems. Keep form storage apart from student and staff systems in authentication and network so a breach does not spread (our view).
Be able to tell each person what was taken about them
The university says it will, after identity verification, tell people which information was affected. With many people involved, responses take time, so storing submissions in a form that can be looked up per person makes notification better (our view).
Sources (public records)
The facts in this article come from the public information below. Attack step details are not covered.
- York University, "Cybersecurity Incident" (official page; checked November 12, 2026) — yorku.ca
Update history
2026-11-12: First version. Based on York University's official page. The date of the notice and the number of people affected are not shown on the page. We will update when more is published.
Read next
- A breach in education: The ETS (California statewide testing) student data breach
- Spotting fake messages: What phishing is
- Other 2026 incidents: Data breaches and cyberattacks of 2026