2026-11-12
York University (Canada) Data Breach: Online Form Submissions from 14 Faculty and Department Sites Stolen, Some Including Health Information. What Affected People Should Do
York University in Canada says an unauthorized actor accessed limited online forms used by university departments and took personal information submitted through them. The university became aware of the incident on October 25, 2026, contained it and began an investigation with external experts. The notice covers 14 faculty and department websites and people who completed online forms on them from a start year shown for each site, between 2007 and 2022, through October 2026. Most of the stolen information was basic, such as York ID numbers and contact details, but depending on the site it also includes date of birth, health information, disability and accommodation status, financial status, legal and criminal background, race and ethnicity, religion, sexual orientation and images. For a small number of people, government identification or financial account information was exposed, and they will receive two years of free credit monitoring and identity theft protection. The number of people affected and the cause have not been published. The university reported the breach to the Information and Privacy Commissioner of Ontario (IPC) and notified law enforcement. Our view: people who may have used one of the listed sites should ask the university what was taken about them and be wary of messages that use details from their form submissions.