York University breach exposes personal data from 14 sites back to 2007

York University says it spotted the unauthorized access on October 25. The intruder reached online forms across 14 university websites, with submissions dating from 2007 through 2026, according to BleepingComputer. The Toronto school has not said how many people were affected.

In a Friday statement, the university said it was hit by a cybersecurity incident involving an unauthorized actor who accessed a limited set of departmental online forms. It added that while it moved quickly to contain the breach once discovered, it regrets confirming the theft of personal information from those forms.

What got taken varies by person. Most of the stolen records held basic contact details and York ID numbers, the university said. The school also broke the exposed data down by category, and some records included government ID or financial account information, which it will flag directly to those people.

Those notified about government ID or financial accounts will get two years of credit monitoring and identity theft protection. Anyone who doesn't receive a notification can contact York to ask which specific data types were exposed in their case. The university says the forms are now secure and safe to use.

York is one of Canada's largest universities, with more than 55,700 students across 200 undergraduate and graduate degree programs and about 7,000 administrative staff. The school has released no details about who was behind the attack, and BleepingComputer found no ransomware group claiming credit for it.