---
title: "York University departmental webforms theft"
description: "York University confirmed theft of departmental webform data, including records collected as early as 2007."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-11"
canonical_url: "https://www.ally.security/incidents/york-university-departmental-webforms-theft-2026"
markdown_url: "https://www.ally.security/incidents/york-university-departmental-webforms-theft-2026.md"
stix_url: "https://www.ally.security/incidents/york-university-departmental-webforms-theft-2026/stix.json"
---

# York University departmental webforms theft

York University confirmed theft of departmental webform data, including records collected as early as 2007.

Last modified Nov 11, 2026 · 1 source

## Summary

- **Environment:** Departmental online forms and historical submissions
- **Operational impact:** Affected forms contained; investigation and notification underway
- **Financial impact:** No confirmed incident cost quantified

## What happened

[York University](https://www.yorku.ca/) confirmed theft of personal information from departmental online forms after discovering an incident October 25, 2026. Its [public FAQ](https://www.yorku.ca/uit/infosec/incident-faq/) describes affected groups and notification. [1](#source-1)

## Impact

Records span department-specific periods beginning as early as 2007 through October 2026; this is not an attacker-access period. Most stolen fields were contact details or university identifiers, with some forms containing health, financial, demographic or other sensitive information. Fields varied by person; no population total was disclosed. [1](#source-1)

## Timeline

### October 25, 2026 — Incident discovered

York began investigation and containment. [1](#source-1)

### November 6, 2026 — Public notice published

The FAQ identified affected departmental groups. [1](#source-1)

### November 11, 2026 — Briefing updated

This briefing was last reviewed and updated on November 11, 2026.

## Threat Group & Attack Vector

The cause remained under investigation. York found no evidence of access beyond the affected systems. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific ATT\&CK technique is mapped from the available evidence.

## Response

York improved web-form security, engaged external experts and notified police and Ontario’s privacy commissioner. A smaller group with government-identifier or financial-account exposure would receive direct notices and two years of identity protection. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/york-university-departmental-webforms-theft-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Cybersecurity Incident: York University departmental forms

official · York University · Nov 6, 2026

<https://www.yorku.ca/uit/infosec/incident-faq/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Affected Organization · 100% confidence · current**  
   York University departmental webforms theft: York University
2. **Occurred At · 100% confidence · current**  
   Incident comes to York’s attention: 2026-10-25
3. **Resulted In · 100% confidence · current**  
   York University departmental webforms theft: Affected forms held records from department-specific starting years, the earliest 2007, through October 2026. This is a data-collection span, not an attacker-access duration. No affected-person total was disclosed.
4. **Resulted In · 100% confidence · current**  
   York University departmental webforms theft: A smaller additional group with exposed government identifiers or financial-account information would receive direct notices and two years of credit monitoring and identity-theft protection.
5. **Resulted In · 100% confidence · current**  
   York University departmental webforms theft: Most stolen fields were contact details or York identifiers; depending on the form, records could also include academic, employment, financial-status, health, demographic or legal-background information. The full category list does not apply to every person.
6. **Disclosed At · 100% confidence · current**  
   York University departmental webforms theft: 2026-11-06
7. **Resulted In · 100% confidence · current**  
   York University departmental webforms theft: York contained the incident, engaged outside experts, improved web-form security and reported to law enforcement and Ontario’s privacy commissioner. It found no evidence of movement beyond affected systems; the cause remained under investigation.
8. **Resulted In · 100% confidence · current**  
   York University departmental webforms theft: Public webforms notification published
9. **Discovered At · 100% confidence · current**  
   York University departmental webforms theft: 2026-10-25
10. **Resulted In · 100% confidence · current**  
   York University departmental webforms theft: York University confirmed theft of personal information submitted through departmental online forms. Its investigation began after the incident came to its attention October 25.
11. **Resulted In · 100% confidence · current**  
   York University departmental webforms theft: Incident comes to York’s attention
12. **Occurred At · 100% confidence · current**  
   Public webforms notification published: 2026-11-06

</details>