TORONTO — York University is investigating a cybersecurity incident resulting in the theft of personal data which was discovered last month. The school said an unauthorized actor accessed information of individuals who completed online forms on select websites, such as residence applications and surveys, ranging from 2007 to October 2026. The breach, discovered on Oct. 25, was limited to a specific list of websites and faculties posted on their website, the school said. York University said a small number of directly affected individuals had their government identification or financial account information exposed. The school said it immediately began an investigation into the breach alongside the help of external experts. The university did not disclose when the incident took place or when it discovered the breach. The investigation found no evidence that the unauthorized actor moved beyond the affected websites or accessed other parts of the university. “Affected individuals should remain alert for suspicious emails, text messages and telephone calls, particularly communications asking for personal information or directing them to unfamiliar websites,” the school said in a news release. It is also asking the affected individuals, who will be contacted directly, to monitor their financial accounts. York University is offering two years of complimentary TransUnion credit monitoring and identity theft protection to the individuals who had their government or financial information exposed. The incident was reported to the Information and Privacy Commissioner of Ontario and law enforcement. “We recognize that this incident may be concerning to you,” the school said. “We take that seriously and regret these circumstances.” This report by The Canadian Press was first published Nov. 8, 2026. Sadeen Mohsen, The Canadian Press
