York University says data stolen from 14 department forms

TORONTO – York University said Nov. 8 that an unauthorized actor stole personal information submitted through online forms run by 14 of its departments and faculties, with some of the affected forms dating back to 2007.

The university said it learned of the incident on Oct. 25 and has reported it to police and to Ontario’s Information and Privacy Commissioner. In a public notice, York said its investigation found no evidence that the intruder moved beyond the web forms into other parts of its computer systems.

The forms were used for meeting registrations, residence applications, surveys and other university business. York’s notice lists each affected website and the first year of affected submissions, running to October 2026. The earliest is the Faculty of Environmental and Urban Change in 2007, followed by the Faculty of Graduate Studies and the Faculty of Liberal Arts and Professional Studies in 2013.

Going through the university’s table, Canada News Media counted what each of the 14 sites collected. Nine of them held health information, which York says can include clinical details such as diagnosis and treatment. Nine held race or ethnicity and nine held Indigenous status. Seven held sexual orientation, eight held financial status such as income and debts, and six held legal or criminal background information. Five held religion and two held vaccination status. Every one of the 14 held York identification numbers, email addresses and phone numbers.

The university stressed that the full list of data types does not apply to every person. “Most stolen information was basic information such as York identification numbers and contact information,” the notice said. It said the table describes categories collected from each group, not what was taken about any one person.

The sites named include the Centre for Refugee Studies, the Department of Psychology, the Division of Students, the Faculty of Science, the Lassonde School of Engineering, the Schulich School of Business, Glendon Housing, Housing and Conference Services, Research and Innovation, the University Secretariat and the Vice-Provost Academic.

York said it will directly notify a small number of people whose government identification or financial account information was exposed, and that they will get two years of complimentary TransUnion credit monitoring and identity theft protection. The university did not say how many people were affected overall. Spokesperson Yanni Dagonas told CBC News that the number whose financial account or government identification information was exposed was small, and that the affected forms were not tied to the university’s main application, human resources or student systems.

York has not said how the intruder got in or when the unauthorized access began. It said it has added security improvements to the forms while the investigation continues.

People who filled out forms on the listed sites during the affected years can email [email protected] to ask what information about them was taken, after York verifies their identity. The university urged anyone affected to watch for suspicious emails, texts and calls, to monitor their financial accounts and to use strong, unique passwords and multi-factor authentication.

The breach follows other privacy incidents in Canada this fall, including the leak of Crime Stoppers tips that led to a probe by the privacy commissioner and the Loblaw data breach. The privacy commissioner is expected to open a file on York’s incident, and the university said anyone affected can also file a complaint with the commissioner.

If you find reporting like this useful, consider supporting Canada News Media, an independent Canadian newsroom with no corporate parent.

Sources: York University’s cybersecurity incident notice (yorku.ca), CBC News.