Cybersecurity Incident

Voir la version française

York University is notifying community members of a cybersecurity incident

York was recently subject to a cybersecurity incident involving an unauthorized actor accessing limited online forms used by University departments. While York acted quickly to contain the incident following discovery, we regret to confirm the theft of personal information from some departmental forms.

York has determined which community members are affected and what information was stolen. The University is now notifying affected individuals. Information about the websites and types of personal information involved appears below.

Who is affected and what information was involved

The incident affects individuals who completed online forms on the following York University websites from the year set out below to October 2026.

These forms were used for a wide variety of university business, for example meeting registrations, residence applications, general surveys and many other uses.

The table below outlines the website and all the types of data that were stolen. Please note that the list of data elements is comprehensive: the full list of elements does not apply to all members of a group, and most stolen information was basic information such as York identification numbers and contact information.

“Health information” may include clinical information such as diagnosis and treatment. “Financial status information” may include information about income and debts. "Legal/criminal background information” may simply indicate that one has no criminal background or sanction from an adjudicative or professional body.

There are also a small number of additional affected individuals who the University will directly notify. Members of this group whose government identification information or financial account information was exposed will receive two years of complimentary TransUnion credit monitoring and identity theft protection services. These notifications will be sent by email.

What York has done

The incident came to the University’s attention on October 25, 2026. York acted quickly to contain the incident and began an investigation with the assistance of external experts.

York took immediate steps to contain the incident and has been working with external experts to investigate its scope and remediate the affected systems. The investigation has found no evidence that the unauthorized actor moved beyond the affected systems or gained access to other parts of the University’s IT environment.

York has reported the privacy breach to the Information and Privacy Commissioner of Ontario and reported the incident to law enforcement. Although we expect the IPC to open a file and investigate, you are entitled to complain.

What affected individuals can do

Affected individuals should remain alert for suspicious emails, text messages and telephone calls, particularly communications asking for personal information or directing them to unfamiliar websites. We encourage affected individuals to monitor their financial accounts for unusual activity and to use strong, unique passwords and multi-factor authentication where available.

We recognize that this incident may be concerning to you. We take that seriously and regret these circumstances. The University is committed to learning from this incident and will continue to strengthen its cybersecurity posture, incident readiness, and safeguards for personal information.

Individuals with questions can contact incident@yorku.ca. Further information will be posted at https://www.yorku.ca/uit/infosec/incident-faq/ as appropriate.

Frequently Asked Questions

What happened?

An unauthorized actor accessed some webforms used by departments of York University and took personal information submitted through those forms. York took immediate steps to contain the incident and engaged external experts to investigate.

What has York done in response?

York immediately contained the incident, investigated its scope, reported the privacy breach to the Information and Privacy Commissioner of Ontario, and reported the incident to law enforcement.

Did the unauthorized actor access other York systems?

After thorough investigation, there is no evidence that the unauthorized actor moved beyond the affected systems or gained access to other parts of the University’s IT environment.

What caused the incident?

York continues to investigate. It has implemented responsive security improvements to its web forms pending further consideration.

Was personal information taken? 

Yes. An unauthorized actor accessed and took personal information.

Is every affected person affected by the theft of all of the information listed in the notice?

No. The information affected varies from person to person. Most stolen information was basic information such as York identification numbers and contact information.

How do I know if I am affected?

Review the affected groups and time periods identified in the notice above. If you fall within one of those groups, this publication serves as York’s notification that your information was affected.

Will York contact me directly?

York will directly notify a small number of individuals, including individuals whose government identification information or financial account information was exposed.

How can I find out exactly what information about me was affected?

If you would like to know what specific types of personal information about you were affected, please contact incident@yorku.ca.  York will first need to verify your identity and then review the affected information. Given the number of individuals affected, responding to individual inquiries may take some time.

Who will receive credit monitoring and identity theft protection?

York will provide two years of complimentary TransUnion credit monitoring and identity theft protection to individuals whose government identification information or financial account information was exposed.

What should I do if I receive an offer of credit monitoring?

York encourages eligible individuals to take advantage of the service. Instructions for enrolling will be provided in the direct notification.

Am I at risk?

Identify fraud is regrettably a risk we all bear every day. Most of the stolen information is not the type of information associated with an elevated risk of such fraud. For those whose government identification or financial information was exposed, we are providing two years of complimentary TransUnion credit monitoring and identity theft protection.

What should I do now?

Remain alert for suspicious emails, text messages and telephone calls, particularly communications asking for personal information or directing you to unfamiliar websites. Monitor your financial accounts for unusual activity and use strong, unique passwords and multi-factor authentication where available.

If you receive a direct notification with a credit monitoring offer, we encourage you to enrol.

What should I do if I notice suspicious activity?

Contact the relevant financial institution or service provider promptly. You may also report suspected fraud to the Canadian Anti-Fraud Centre and to York.

What is York doing to prevent this from happening again?

York has implemented responsive security improvements to its web forms pending further consideration.

Will York provide further information?

Further information will be posted at https://www.yorku.ca/uit/infosec/incident-faq/ as appropriate.

Who can I contact with questions?

Individuals with questions can contact incident@yorku.ca.