York University in Toronto said it found a cybersecurity incident on 25 October 2026 in which an unauthorised actor reached departmental web forms and took personal information. The catalog entry records a confirmed theft from forms used for residence applications, surveys, meeting sign-ups and other department business, some dating to 2007. Most stolen records are York identification numbers and contact data. A small set includes government identification or financial-account information. Those people get two years of TransUnion credit monitoring. The university has not published a people count, so recordsAffected stays 0. Core student, HR and applications systems were not reached, the FAQ says.
York reported the privacy breach to the Information and Privacy Commissioner of Ontario and reported the incident to law enforcement. People with questions can write to incident@yorku.ca after the university verifies identity. Do not treat this as a New York University row. That is a different institution.
What happened in the York University data breach?
Someone reached a limited set of department web forms, not the live student-information system. York contained the incident, hired outside specialists, and says the investigation found no movement into the rest of the IT environment. The cause is still under investigation. Responsive security changes were made on the forms while that work continues.
A forms archive that starts in 2007 is a long retention problem. People who filled a housing or survey form a decade ago can still be in the take even if they never logged into current York portals. That is closer to an old web-form store than to a current SIS dump. It is also separate from Harvard's alumni-development file, which is a different university and a different system.
If you only used official application or enrolment systems and never submitted one of the listed department forms in the listed years, this notice does not automatically put you in the stolen set. If you did submit one of those forms, the public table is your notice even without a personal email.
The FAQ also says you may complain to the Information and Privacy Commissioner of Ontario even though York has already reported the file. That is a statutory right, not a second incident. If you want a field-level inventory for yourself, York will verify identity first and warns that replies will be slow because of volume.
What data was exposed?
The FAQ lists 14 sites. The earliest start year is 2007 for the Faculty of Environmental and Urban Change. Other faculties and units start between 2013 and 2022. Each row is a comprehensive field list for that population, not a promise that every person has every field. York says most stolen information was basic: identification numbers and contacts. Health information may include diagnosis and treatment. Financial status may include income and debts. Legal or criminal background may be a "no record" flag rather than a file of offences.
Government identification and financial-account information apply only to a small additional group that York is emailing directly. Those people get the TransUnion offer. Everyone else on the listed sites is notified by the public page. Census unpublished. Do not invent a million-person headline.
Listed units include the Centre for Refugee Studies, Psychology, Division of Students, several faculties, Glendon Housing, Housing and Conference Services, Lassonde, Research and Innovation, Schulich, the University Secretariat and the Vice-Provost Academic office. A refugee-studies form can hold citizenship and legal-background fields that a conference RSVP does not. That is why the FAQ repeats that the table is comprehensive for the population, not for each person.
Who is affected?
Anyone who completed an online form on one of the listed York sites from that site's start year through October 2026. That can include students, staff, visitors, survey respondents and family contacts stored on the form. People whose only York record sits in the core student system are outside this row on the current notice. New York University California AG filings are unrelated.
What should I do?
- Read the site table on yorku.ca. If you submitted a listed form in the listed years, treat yourself as notified.
- If you receive a direct email about government ID or a financial account, enrol in the TransUnion product named in that email, not in a search-ad.
- Watch for fake "York security desk" mail that asks you to upload a passport or a void cheque. Officials will not collect those through a surprise link.
- Use unique passwords and multi-factor authentication on email. Form contact data is a phishing file.
- Canadians can report suspected fraud to the Canadian Anti-Fraud Centre. Keep the FAQ URL. When a census is published, that figure replaces the catalog zero.
The Harvard timeline post is a different campus. The SMBC Consumer Finance post is the other large November identity file, and it is a Japanese lender, not a university form store.
Frequently asked questions
How many people were affected?
Unpublished. York is notifying from a site-and-year table rather than a public headcount. recordsAffected stays 0 until a matched census exists.
Were core student records stolen?
York says there is no evidence the actor moved beyond the affected forms into student, HR or applications systems.
Is this New York University?
No. York University is in Toronto. NYU is a separate catalog company.
When was this found?
25 October 2026. The public FAQ with the site table is the notice used for this catalog row.
Who gets credit monitoring?
Only the small group whose government identification or financial-account information was exposed, via a direct email with TransUnion instructions.
Sourcing note: discovery date, form-not-SIS scope, field lists, IPC and police reports, and the TransUnion offer come from York University's incident FAQ. English coverage: CBC.