York University in Toronto has confirmed that someone gained unauthorised access to the online forms its departments use and stole personal information. The stolen data includes contact details and student ID numbers. The university found the intrusion on October 25, 2026. The forms affected date from 2007 to October 2026, so people who filled one in nearly two decades ago may be affected. York says a smaller group also had government-issued ID or financial account details exposed. It has not said how many people are affected, whether they are students, staff or members of the public, or who carried out the attack.
What Happened
CBC News reports, citing a news release on York's website, that "an unauthorized actor" got into online forms used across the university's departments. These forms handled what York calls a "wide variety of university business," including residence applications and general surveys. The university says it moved quickly to contain the incident after finding it on October 25, but some personal information had already been stolen.
Deputy spokesperson Yanni Dagonas told TorontoToday that the intruder "accessed a limited number of online forms." Dagonas said the forms "do not impact primary university systems, such as applications, HR or student systems." According to the university, there is no evidence the intruder moved beyond the affected systems into the wider IT network. York is working with outside experts to investigate and fix the affected systems. It has reported the incident to the Information and Privacy Commissioner of Ontario and to law enforcement.
Some key details are still missing. CBC notes that York has not said when the intrusion actually began, or how long the attacker had access before it was found. The university also declined TorontoToday's questions about how many people were affected and who they are. No group has claimed the attack, and York has not named a suspect.
The incident comes shortly after a change in York's security leadership. The university's own news site reported on October 14 that Chris Russel, York's chief information security officer since 2019, had died after an illness. Nothing suggests a link between his death and the breach, and York has not commented on it.
What Was Taken
The university's account describes two groups of affected people:
- Most affected people: identifying and contact information plus student ID numbers. CBC's report and the university's statement to TorontoToday agree on this.
- A smaller group: government-issued ID or financial account information. TorontoToday reports this, citing the York spokesperson. CBC's account of the public news release mentions only contact details and student ID numbers, so the release appears to have played down the more sensitive data that the spokesperson confirmed. York says it has contacted this group directly and offered two years of free credit monitoring and identity theft protection.
York has not given a record count, and no figure has appeared in any reporting. The forms cover almost 20 years of data, from 2007 to 2026. That means the affected people likely include former students, alumni, past applicants for residence, and anyone who answered a departmental survey, not just people at the university today.
Why It Matters
Old forms keep old data. Departmental forms tend to multiply without central oversight. Every department builds its own, and the submissions often stay in a forms platform for years after anyone needs them. York's breach reached back to 2007. A tool used to collect survey answers or residence requests ended up holding ID documents and banking details. Data that was never deleted was there to be stolen.
Contact details plus student IDs make convincing scams. Someone who has your name, email, phone number and student ID can pose as the university's registrar, housing office or financial aid team very believably. York's own information security team warned on October 19, before the breach was announced, about a tuition payment scam spreading across Canada. In that scam, callers pretend to be from the victim's bank, using caller ID that shows the bank's real number, and talk the victim into approving tuition payments for strangers. In one case reported by CBC, a Vancouver resident lost more than $37,000. Stolen student contact data fits this kind of scam well.
Universities are being targeted widely. In the weeks before York's announcement, several separate reports described attacks on universities:
- Cybernews says it found an exposed attacker server showing that at least 42 universities had been identified as potential targets through flaws in QuickLaunch, a sign-on product used in higher education. QuickLaunch says it has found no evidence its platform was compromised.
- The University of Texas Regional Security Operations Center, summarising research from Symantec, reports that the group behind Warlock ransomware is still breaking into unpatched on-premises SharePoint servers, including at least one university.
- A joint advisory from seven countries, AA26-281A, accompanied the FBI's seizure of domains behind MicroScan and FishHub, scanning tools that the advisory says were used against universities, among other targets.
None of these reports mentions York, and York has not linked its incident to any of them. They show that university systems facing the internet are under constant attack. They say nothing about how York was breached.
The Attack Technique
York has not said how the attacker got into its forms. It has not named the forms platform, said whether stolen credentials, a software flaw or a misconfiguration was involved, or said whether a third-party vendor was involved. Because the intrusion stayed within the forms environment, the attacker may have used a weakness in the forms application or its storage, rather than a foothold inside the main network. That is an inference, not a finding the university has confirmed.
So far nothing points to ransomware. York has not reported any disruption, encryption or extortion demand. The facts it has disclosed are consistent with data theft only.
Until York publishes more, defenders should treat the method as unknown. They should not assume that any of the attack campaigns against universities described above was used here.
What Organizations Should Do
- List every forms platform and what it holds. Find every departmental form, including old ones, along with where the submissions are stored and who can reach them. Pay special attention to forms that collect ID documents or banking details.
- Set retention limits and enforce them. Delete or archive submissions once their purpose is over. A survey from 2007 should not still be sitting in a live system that faces the internet.
- Keep sensitive uploads out of general forms. Send ID documents and financial information through dedicated systems with tighter access controls and logging, not through general forms or survey tools.
- Put forms behind central sign-on and multi-factor authentication. Require single sign-on and MFA for both form administrators and the accounts that can read submissions. Remove shared and stale accounts.
- Patch and monitor what faces the internet. Follow advisory AA26-281A's basic priorities: identity and access management, MFA on webmail and VPNs, and fast patching. Check any on-premises SharePoint servers against the ToolShell fixes and the newer flaws CISA has flagged.
- Warn affected people about specific scams. Tell people that the university will never ask them to approve banking app prompts, read back one-time codes, or pay someone else's tuition. Give them a verified way to report suspicious contact.
Sources: York University warns of personal data theft in cybersecurity incid... | York University cyberattack: Government IDs, financial information... | Passings: Chris Russel - YFile | Growing Tuition Payment Scam Targets Canadians Through Fake Bank Fr... | Hackers’ infrastructure leak exposed a university data hunt Cybernews | A year after ToolShell, Warlock ransomware is still walking through... | A US university: how they got in LeakTrace | Integrity Tech MicroScan and FishHub seized: AA26-281A