The unauthorized access was discovered on October 25 and affected forms submitted on 14 university websites between 2007 and 2026. York University is a major university based in Toronto, Canada, with more than 55,700 students across 200 undergraduate and graduate degree programs, and an administrative staff of 7,000.
"York was recently subject to a cybersecurity incident involving an unauthorized actor accessing limited online forms used by University departments," the university stated on Friday. "While York acted quickly to contain the incident following discovery, we regret to confirm the theft of personal information from some departmental forms."
The announcement lists the exposed data in detail, by category. Across the affected forms, the attacker accessed the following: The exact data types exposed vary by person, and most stolen records contained basic contact information and York ID numbers, the university said.
