York University breach exposed personal information dating to 2007

York University in Toronto has confirmed that a threat actor breached its systems and accessed personal information submitted through online forms.

The unauthorized access was discovered on October 25 and affected forms submitted on 14 university websites between 2007 and 2026.

York University is a major university based in Toronto, Canada, with more than 55,700 students across 200 undergraduate and graduate degree programs, and an administrative staff of 7,000.

“York was recently subject to a cybersecurity incident involving an unauthorized actor accessing limited online forms used by University departments,” the university stated on Friday.

“While York acted quickly to contain the incident following discovery, we regret to confirm the theft of personal information from some departmental forms.”