York University breach steals sensitive personal data from departmental online forms
TL;DR
York University confirmed a threat actor breached its systems and accessed personal data submitted through departmental online forms. The breach impacts users of 14 university websites and requires individuals to monitor for direct notifications regarding exposed sensitive information.
What happened
York University discovered unauthorized access to its systems on October 25. The breach involved a threat actor accessing various departmental online forms submitted across 14 university websites between 2007 and 2026.
The university stated that while it acted quickly to contain the incident, personal information was stolen. This data includes email addresses, phone numbers, York identification numbers, government ID information, financial status, health information, academic history, employment history, and criminal background. Most stolen records contained basic contact information and York ID numbers, though the specific data types vary by individual.
Why it matters
The exposure of highly sensitive data, such as government IDs and financial status, alongside contact details, creates a significant risk of targeted phishing and social engineering attacks. Because the breach spans nearly two decades of submissions, the scope of the compromised data is likely substantial. The university has stated that the affected website forms are now secure and safe to use.
Who is affected
- York University students and staff
- Users of 14 university departmental websites
What to do now
- Watch for direct notifications from York University if your government ID or financial account information was exposed.
- Contact the university directly to confirm which specific types of data were exposed in your case if you have not received a notification.
- Enroll in the two years of credit monitoring and identity theft protection coverage offered by the university if you are eligible.
- Monitor all personal accounts and stay alert for increased phishing or social engineering attempts using your contact details.
What we don't know yet
- The total number of individuals impacted by the breach.
- The identity or name of the threat actor.
- The specific method or vulnerability used to access the forms.
- Whether a ransomware group has claimed responsibility for the attack.
Sources
