York University warns of personal data theft in cybersecurity incident

Juno News reports that York University confirmed an "unauthorized actor" stole personal information submitted through online forms across 14 university websites.[2] According to CyberInsider, the university discovered the incident on October 25, 2026, and brought in external experts to investigate[3].TorontoToday.ca reports that the stolen data includ[ed] some government-issued identification and financial account details.[4] BleepingComputer reports that, according to the university, most stolen records contained basic contact information and York ID numbers[5].York deputy spokesperson Yanni Dagonas told CBC that the impacted forms were not tied to the university's primary systems, such as applications, human resources or student systems[1].The Canadian Press, via CP24, reports that York is offering two years of complimentary TransUnion credit monitoring and identity theft protection[6] to people whose government or financial information was exposed.CBC reports that the university reported the incident to police and to the Information and Privacy Commissioner of Ontario, who is expected to open an investigation.[1]CyberInsider reports that York has not disclosed how many people were affected, how the attacker gained access, or when the unauthorized access began.[3] BleepingComputer said it did not find any ransomware group claiming the attack.[5]In a statement reported by CP24, York said: "We take that seriously and regret these circumstances."[6]