York University confirms theft of personal data from 14 departmental web forms, with records dating back to 2007
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 10/11/2026 00:03; os links antigos trazem para cá.
York University in Toronto confirmed that an unauthorized actor accessed limited online webforms on 14 departmental and faculty websites and stole personal information submitted through them. The intrusion was discovered on October 25, 2026, and the oldest affected submissions date to 2007 (securityonline.info, bleepingcomputer.com). The forms were used for meeting registrations, residence applications and surveys (securityonline.info). Most people lost only basic identifiers such as York ID numbers, contact details and street addresses. Some forms also exposed dates of birth, citizenship, disability accommodation, vaccination status, race, religion, Indigenous status, health and financial information, and government ID details (securityonline.info, bleepingcomputer.com). York has not published a total count of affected people. It reports no evidence that the attacker reached other parts of its IT environment, and no group has claimed the attack (securityonline.info, bleepingcomputer.com). York contained the incident, engaged external experts, and reported the breach to the Information and Privacy Commissioner of Ontario and to law enforcement (bleepingcomputer.com, securityonline.info). bleepingcomputer.com rates the criticality as medium, because the most sensitive data (government ID and financial account numbers) is limited to a small group that York will notify directly.
Detalhes técnicos
- The attack entered through the webform platform. The entry method has not been disclosed and York's investigation continues (securityonline.info, bleepingcomputer.com).
- No CVE, CVSS score, ATT&CK mapping, malware family or threat actor is named in the sources reviewed.
- The exposed fields vary by form and by person. York's per-site table lists further items for specific forms, including diet or allergy information, gender, images and photos, family or third-party contacts, legal or criminal background and sexual orientation (securityonline.info, citing yorku.ca).
- Per-site submission windows run from 2007 for the Faculty of Environmental and Urban Change to 2022 for the Vice-Provost Academic (securityonline.info).
Remediação
- Treat unsolicited emails, texts and calls asking for personal information as suspicious, monitor financial accounts, use unique passwords and enable multi-factor authentication (securityonline.info, bleepingcomputer.com).
- People whose government ID or financial account numbers were exposed will be notified directly by email and offered two years of TransUnion credit monitoring and identity theft protection, with enrolment instructions in the notice (securityonline.info, bleepingcomputer.com).
- Report suspected fraud to the financial institution and the Canadian Anti-Fraud Centre (securityonline.info, bleepingcomputer.com).
- Questions about individual exposure can go to [email protected]. York requires identity verification before reviewing a person's data (bleepingcomputer.com).
Relatos divergentes
- Hardening status: securityonline.info says engineers already deployed security updates to the webforms. bleepingcomputer.com, which is more recent (2026-11-09 21:22 UTC), says only that York made "responsive security improvements" to the forms, pending further consideration, which matches the wording securityonline.info attributes to York's own notice. Treat the claim that the forms are fully hardened as unverified.
- Date range: bleepingcomputer.com says the affected forms were completed between 2007 and October 2026. securityonline.info reports per-site windows, one of which ends in 2022. The sources do not reconcile the two, and the upper bound of the range is unclear.
Linha do tempo
-
York University confirms theft of personal data from departmental web forms dating back to 2007
ler a análise desta fonte ocultar
York University in Toronto has confirmed that an unauthorized actor accessed limited online forms used by university departments and took personal information submitted through them. The intrusion was discovered on October 25 and affected people who completed forms on 14 York websites between 2007 and October 2026 (yorku.ca). The exposed fields include the York identification number, government ID information and third-party contact information, and they vary by person, with most stolen records holding only basic contact details and York ID numbers (yorku.ca). York says it contained the incident, engaged external experts, reported the privacy breach to the Information and Privacy Commissioner of Ontario and reported the incident to law enforcement (yorku.ca). Criticity is medium rather than high: the government ID and financial account data is limited to a small group that York will notify directly, no group has claimed the attack, and no exploited vulnerability or access vector has been disclosed, while the total number of affected people remains unpublished.
Technical Details
- The access path is not disclosed. York says its investigation continues and that it has made responsive security improvements to its web forms, pending further consideration (yorku.ca).
- The scope covers forms on 14 departmental and faculty websites. The number of affected individuals has not been published.
- Neither the article nor York's notice names a CVE, a malware family or a threat actor.
Remediation
- Affected individuals should be alert to suspicious emails, text messages and calls, especially those asking for personal information, monitor financial accounts, use unique passwords and multi-factor authentication, and report suspected fraud to the Canadian Anti-Fraud Centre (yorku.ca).
- People whose government ID or financial account information was exposed will receive two years of TransUnion credit monitoring and identity theft protection, with enrolment instructions in the direct notification (yorku.ca).
- Questions about individual exposure can be sent to [email protected], where York requires identity verification before reviewing the data (yorku.ca).
-
York University confirma roubo de dados pessoais de formulários web departamentais com registros desde 2007
ler a análise desta fonte ocultar
York University disclosed the theft of personal information from online forms on 14 departmental and faculty websites. An unauthorized actor reached limited webforms used for meeting registrations, residence applications and surveys, and the intrusion was discovered on October 25, 2026. The oldest affected submissions date to 2007, and the York notice states that the exposed fields vary by form and by person (yorku.ca). Most people lost only basic identifiers such as York ID numbers, contact details and street addresses, while some forms also exposed dates of birth, citizenship, disability accommodation status, vaccination status, race, religion, Indigenous status, health and financial information. York has not published a total record count, and it reports no evidence that the attacker reached other parts of its IT environment (yorku.ca).
Technical Details
- The attack entered through the webform platform and the entry method is not public; the university and the article both say the investigation of the exact weakness is ongoing (yorku.ca). No CVE, CVSS score or ATT&CK mapping is available in the sources reviewed.
- The York table lists the data elements per website, including items the article does not mention, such as diet or allergy information, gender, images and photos, family or third-party contacts, legal or criminal background and sexual orientation, for specific forms (yorku.ca).
- Per-site submission windows run from 2007 for the Faculty of Environmental and Urban Change to 2022 for the Vice-Provost Academic (yorku.ca).
Remediation
- Affected people should treat unsolicited emails, texts and calls asking for personal data as suspicious, monitor financial accounts, and use unique passwords with multi-factor authentication (yorku.ca).
- Individuals whose government ID or financial account numbers were exposed will receive email notices and two years of TransUnion credit monitoring. Suspected fraud should be reported to the financial institution and the Canadian Anti-Fraud Centre (yorku.ca).
- Questions can go to [email protected] (yorku.ca).
- York reported the privacy breach to the Information and Privacy Commissioner of Ontario and to law enforcement (yorku.ca).
- The article says engineers already deployed security updates to the webforms. York's own notice describes only "responsive security improvements" that are pending further consideration (yorku.ca), so the hardening status should be treated as unverified.