York University confirms theft of personal data from departmental web forms dating back to 2007
York University in Toronto has confirmed that an unauthorized actor accessed limited online forms used by university departments and took personal information submitted through them. The intrusion was discovered on October 25 and affected people who completed forms on 14 York websites between 2007 and October 2026 (yorku.ca). The exposed fields include the York identification number, government ID information and third-party contact information, and they vary by person, with most stolen records holding only basic contact details and York ID numbers (yorku.ca). York says it contained the incident, engaged external experts, reported the privacy breach to the Information and Privacy Commissioner of Ontario and reported the incident to law enforcement (yorku.ca). Criticity is medium rather than high: the government ID and financial account data is limited to a small group that York will notify directly, no group has claimed the attack, and no exploited vulnerability or access vector has been disclosed, while the total number of affected people remains unpublished.
Detalhes técnicos
- The access path is not disclosed. York says its investigation continues and that it has made responsive security improvements to its web forms, pending further consideration (yorku.ca).
- The scope covers forms on 14 departmental and faculty websites. The number of affected individuals has not been published.
- Neither the article nor York's notice names a CVE, a malware family or a threat actor.
Remediação
- Affected individuals should be alert to suspicious emails, text messages and calls, especially those asking for personal information, monitor financial accounts, use unique passwords and multi-factor authentication, and report suspected fraud to the Canadian Anti-Fraud Centre (yorku.ca).
- People whose government ID or financial account information was exposed will receive two years of TransUnion credit monitoring and identity theft protection, with enrolment instructions in the direct notification (yorku.ca).
- Questions about individual exposure can be sent to [email protected], where York requires identity verification before reviewing the data (yorku.ca).
Linha do tempo
-
York University confirms theft of personal data from departmental web forms dating back to 2007
ler a análise desta fonte ocultar
York University in Toronto has confirmed that an unauthorized actor accessed limited online forms used by university departments and took personal information submitted through them. The intrusion was discovered on October 25 and affected people who completed forms on 14 York websites between 2007 and October 2026 (yorku.ca). The exposed fields include the York identification number, government ID information and third-party contact information, and they vary by person, with most stolen records holding only basic contact details and York ID numbers (yorku.ca). York says it contained the incident, engaged external experts, reported the privacy breach to the Information and Privacy Commissioner of Ontario and reported the incident to law enforcement (yorku.ca). Criticity is medium rather than high: the government ID and financial account data is limited to a small group that York will notify directly, no group has claimed the attack, and no exploited vulnerability or access vector has been disclosed, while the total number of affected people remains unpublished.
Technical Details
- The access path is not disclosed. York says its investigation continues and that it has made responsive security improvements to its web forms, pending further consideration (yorku.ca).
- The scope covers forms on 14 departmental and faculty websites. The number of affected individuals has not been published.
- Neither the article nor York's notice names a CVE, a malware family or a threat actor.
Remediation
- Affected individuals should be alert to suspicious emails, text messages and calls, especially those asking for personal information, monitor financial accounts, use unique passwords and multi-factor authentication, and report suspected fraud to the Canadian Anti-Fraud Centre (yorku.ca).
- People whose government ID or financial account information was exposed will receive two years of TransUnion credit monitoring and identity theft protection, with enrolment instructions in the direct notification (yorku.ca).
- Questions about individual exposure can be sent to [email protected], where York requires identity verification before reviewing the data (yorku.ca).