Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

York University says web-form breach exposed data from 2007 to 2026

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

York University isolated stolen web-form records dating to 2007; the number of people affected is unknown and no group has claimed the attack.

York University in Toronto confirmed that an unauthorized actor accessed limited online forms and stole personal information. Access discovered on October 25 covered submissions from 2007 through 2026. BleepingComputer reports forms on 14 university websites; DataBreaches.net describes 14 faculties plus administrative secretariats and student housing. Exposed fields vary and can include contact details, York IDs, government ID, health, academic, employment, financial, criminal-background and demographic data. The university says the forms are now secure, will notify people whose government ID or financial account data was exposed, and will offer two years of credit monitoring. No perpetrator has been named and no group has claimed the attack.

Key facts
  • Most stolen records held contact details and York ID numbers.
  • Victim count is unknown; York has over 55,700 students and 7,000 staff.
  • People not notified can ask the university which data types were exposed.
  • Health data may include diagnosis and treatment; financial data may include income and debts.
  • Threat monitors flagged the exposure in cybercrime channels on November 11.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 25, 2026University detects unauthorized access and isolates form applications. · DataBreaches.net
  2. Nov 11, 2026Threat monitors flag the exposure in cybercrime channels. · DataBreaches.net

What each outlet adds

beyond the shared facts
  • BleepingComputerUnknown victim count, staff and student totals, credit monitoring and notification plan.
  • DataBreaches.netForm isolation, clinical and debt details, and November 11 channel flag.
Victims
York University
Countries
Canada

Coverage

oldest first · one row per article · UTC
  1. · 1d ago BleepingComputerFirst report

    York University breach exposed personal data from forms dating to 2007

    Forms on 14 sites held emails, government IDs, health and financial data; the number of people affected is unknown.

  2. · 5h ago DataBreaches.net

    York University breach exposes 19 years of student health and financial data

    Archived webform submissions from 2007 through October 2026 were taken across 14 faculties, and no group has claimed the attack.