York University says breach exposed online form data back to 2007

What happened?

1. York University said it discovered on Oct. 25, 2026 that an unauthorized actor had accessed online forms on 14 university websites, with exposed submissions dating between 2007 and 2026
2. York University said most affected records contained contact information and York ID numbers, that a small number of people had financial account or government identification information exposed, and that the number of people affected has not been specified

York University said an unauthorized actor accessed online forms on 14 university websites, with exposed submissions dating from 2007 to October 2026, and that it discovered the incident on Oct. 25. The university said most stolen records contained contact information and York ID numbers, and that a small number of people had financial account or government identification information exposed. It said it will directly notify those whose government ID or financial data was exposed and offer them two years of credit monitoring and identity theft protection.

A machine summary written from the reports listed below; read them for the full account. How summaries are made and what is checked.