Canada's York University: departmental web forms accessed without authorization, personal data submitted since 2007 stolen

York University in Toronto announced that an unauthorized actor accessed some online forms used by its departments and stole personal information, an incident it became aware of on October 25, 2026 ^[1]. BleepingComputer reports the affected forms were submitted on 14 university websites between 2007 and 2026; data varies by person, mostly contact details and York ID numbers but in some cases government ID, health, financial status and criminal background, and the number affected has not been disclosed ^[2]. Affected people should watch for suspicious emails, texts and calls, monitor financial accounts, and use strong unique passwords and multi-factor authentication ^[1].

Industries mainly affected: Education

Affected people should watch for suspicious emails, texts and calls, monitor financial accounts, and use strong unique passwords and multi-factor authentication ^[1]