York University breach exposed personal information dating to 2007

York University in Toronto has confirmed a data breach where a threat actor accessed personal information submitted through online forms on its websites. This breach, discovered on October 25, affects forms submitted on 14 university websites over nearly two decades, from 2007 to 2026. The incident highlights the risks associated with long-term data retention and the potential for misuse of personal information.

York University, a major educational institution with over 55,700 students and 7,000 staff members, reported that the unauthorized access involved limited online forms used by various university departments. The university acted swiftly to contain the breach upon discovery, but confirmed that personal information was stolen. The exposed data varies by individual, with most records containing basic contact information and York ID numbers. This exposure raises the risk of phishing and social engineering attacks for those affected.

In response to the breach, York University stated that the compromised website forms are now secure and safe for use. The university plans to directly notify individuals whose government ID or financial account information was exposed, offering them two years of credit monitoring and identity theft protection. Those not receiving a notification can contact the university to ascertain which specific types of data were exposed in their case.

The university has not disclosed the number of individuals impacted by the breach, nor has it provided details about the perpetrators. There is no indication that a ransomware group has claimed responsibility for the attack.