York University says web forms from 2007 were stolen

CityNews reported that York University is investigating the theft of personal data from online forms filled in between 2007 and October 2026. The forms span 19 years, so the question is how much of what was taken puts people at risk.

York said the forms served many kinds of university business, including meeting registrations, residence applications and general surveys. The breach, discovered on October 25, was limited to a list of websites and faculties that York has posted. The investigation found no evidence that the attacker got beyond the affected websites into other parts of the university.

York said most of the stolen information was basic, such as York ID numbers and contact details, and is not the kind linked to a higher risk of identity fraud. But a small number of people had government identification or financial account information exposed. What was taken varies from person to person.

For those whose government or financial information was exposed, York is offering two years of free TransUnion credit monitoring and identity theft protection. It tells all affected people to watch for suspicious emails, texts and calls, to monitor their financial accounts, and to use strong, unique passwords and multi-factor authentication. York said it has improved security on its web forms and reported the incident to Ontario’s privacy commissioner and to law enforcement. Anyone who wants to know exactly what was taken can email [email protected], and York will first verify their identity.

Sources: CityNews · York University