2026 York University — data leak; departmental forms to 2007
Data compromised
Forms used for residence applications, surveys, meeting sign-ups and other department business, some dating to 2007. Most records: York identification numbers and contact data. Fields vary by site and can include academic history, dates of birth, health, financial status, family contacts and, for a small notified set, government ID or financial-account information. Census unpublished (recordsAffected 0). Core student systems not reached.
Technical writeup
Company FAQ lists 14 sites with start years from 2007 (Faculty of Environmental and Urban Change) to 2022 (Vice-Provost Academic). People whose government ID or financial accounts left get two years of TransUnion monitoring. Contact incident@yorku.ca.
Root cause
An unauthorised actor reached a limited set of departmental web forms, not the core student, HR or applications systems. York found the incident on 25 October 2026, contained it, and hired outside specialists. Cause unpublished. Reported to the Information and Privacy Commissioner of Ontario and to police.