York University in Toronto is investigating a cybersecurity incident in which an unauthorized actor stole personal data. The breach was discovered on Oct. 25, and the university has said that a small number of directly affected individuals had their government identification or financial account information exposed.
The school said the unauthorized actor accessed information from people who completed online forms on select websites, including residence applications and surveys. The information covered submissions made from 2007 to October 2026.
The university said the breach was limited to a specific list of websites and faculties posted on its site. The investigation found no evidence that the unauthorized actor moved beyond the affected websites or accessed other parts of the university.
York University said it began an investigation immediately after the breach was discovered, working with external experts. The university did not disclose when the incident took place or when it discovered the breach.
The school said the individuals affected will be contacted directly. It is asking them to monitor their financial accounts and to remain alert for suspicious emails, text messages and telephone calls, particularly those asking for personal information or directing them to unfamiliar websites.
York University is offering two years of complimentary TransUnion credit monitoring and identity theft protection to individuals whose government or financial information was exposed.
The incident has been reported to the Information and Privacy Commissioner of Ontario and to law enforcement. In a news release, the school said: « We recognize that this incident may be concerning to you. We take that seriously and regret these circumstances. »
The York University incident affects people who used online forms on select university websites, including residence applications and surveys, over a period running from 2007 to October 2026. The university has described the scope as limited to a specific list of websites and faculties posted on its site, which is the basis for its finding that other parts of the institution were not accessed.
For people in Ontario and elsewhere in Canada who submitted information through these forms, the practical consequence is that they should expect direct contact from the university. The school has said it will reach each affected individual personally, so messages that arrive outside that process deserve caution, since the university itself has warned about suspicious communications that ask for personal details or send recipients to unfamiliar websites.
The Canadian Press first reported the incident on Nov. 8, 2026, in a story that drew on the university's news release. The reporting confirms the same core facts as the university's own account: the discovery date of Oct. 25, the limitation to selected websites and faculties, and the offer of two years of credit monitoring and identity theft protection.
The university has not said when the unauthorized actor first gained access, which leaves the timeline of the intrusion unresolved. Its statement sets out the steps taken so far, including the investigation with external specialists and the notifications to the privacy commissioner and police, and it does not describe further steps beyond those.