York University in Toronto has confirmed that an unauthorised person stole personal information submitted through a limited number of departmental web forms, in a breach that reaches back to records from 2007. The university said it found the incident on 25 October 2026, contained the affected systems and brought in external experts to investigate.

The forms were used for activities including meeting registrations, residence applications and surveys, and sat on 14 named York websites or organisational units. Most of the affected records held basic contact details, but a smaller group of people had government-issued identification or financial account information exposed. The university is contacting those people directly and offering them two years of credit monitoring and identity-theft protection through TransUnion.

What York University has done since the discovery

York said its investigation found no evidence that the intruder moved beyond the affected forms or reached other parts of its IT environment. It has reported the privacy breach to the Information and Privacy Commissioner of Ontario and to law enforcement, and the cause remains under investigation. The university has not said how many people are affected, or when the intrusion first took place.

People who want to know which types of information about them were affected can contact the university at the address given in its incident notice. York said the table in its notice lists data types by population, rather than a complete set of items stolen from every person.