Summary
- Environment: Departmental online forms and historical submissions
- Operational impact: Affected forms contained; investigation and notification underway
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed November 11, 2026; updated as evidence emerges.
What happened
York University confirmed theft of personal information from departmental online forms after discovering an incident October 25, 2026. Its public FAQ describes affected groups and notification. [1]
Impact
Records span department-specific periods beginning as early as 2007 through October 2026; this is not an attacker-access period. Most stolen fields were contact details or university identifiers, with some forms containing health, financial, demographic or other sensitive information. Fields varied by person; no population total was disclosed. [1]
Timeline
Threat Group & Attack Vector
The cause remained under investigation. York found no evidence of access beyond the affected systems. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific ATT&CK technique is mapped from the available evidence.
Response
York improved web-form security, engaged external experts and notified police and Ontario’s privacy commissioner. A smaller group with government-identifier or financial-account exposure would receive direct notices and two years of identity protection. [1]