York University data breach
York University announced a data breach on Nov 6, 2026, exposing email addresses, phone numbers, addresses and dates of birth. The number of people affected has not been disclosed. It was caused by a cyberattack. No settlement or compensation has been announced.
Was I affected?
You may be affected if you filled in an online form on one of the 14 York University department websites listed in its notice (for example the Division of Students, Schulich School of Business, Faculty of Science or Housing) between 2007 and October 2026. York is notifying affected people, and those whose government ID or financial account details were exposed get two years of TransUnion credit monitoring by email.
| Announced | Nov 6, 2026 |
|---|---|
| When it happened | Discovered October 25, 2026; affected forms were submitted on 14 university websites from as early as 2007 up to October 2026 |
| Country | Canada |
| Data exposed | Email addresses, Phone numbers, Addresses, Dates of birth, Medical information, Bank or financial details and Other details |
| Status | Confirmed by the company or a regulator filing |
What happened
York University in Toronto said an unauthorized actor got into online forms used by university departments and stole personal information submitted through them. The incident came to its attention on October 25, 2026. It covers forms on 14 university websites, such as residence applications, meeting registrations and surveys, filled in from as early as 2007 up to October 2026. Most stolen records held basic details such as York ID numbers and contact information, but depending on the form they could also include date of birth, health and disability information, financial status, citizenship, race, religion, sexual orientation, criminal background checks and photos. York has not said how many people are affected; it reported the breach to Ontario's Information and Privacy Commissioner and to law enforcement.
What should I do?
- Check York's incident page (yorku.ca/uit/infosec/incident-faq) for the list of websites and data, and email incident@yorku.ca if you're unsure whether you're affected.
- If you're offered TransUnion credit monitoring, enrol before the deadline in your notification email.
- Be wary of emails, texts and calls that mention your York ID, courses or residence; York says it never asks for passwords or banking details.
- Watch your bank and credit accounts for activity you don't recognize, and use a unique password with multi-factor authentication on your York account.
- If your government ID details were exposed, ask the issuing office whether you should replace the document.
More data breaches in Canada →
Check the other services you use →
Sources
- Cybersecurity Incident · York University · official
- York University breach exposed personal information dating to 2007 · BleepingComputer · news