listed on the York University website.

York was recently subject to a cybersecurity incident involving an unauthorized actor accessing limited online forms used by University departments. While York acted quickly to contain the incident following discovery, we regret to confirm the theft of personal information from some departmental forms.

York has determined which community members are affected and what information was stolen. The University is now notifying affected individuals. Information the websites and types of personal information involved appears below.

Who is affected and what information was involved

The incident affects individuals who completed online forms on the following York University websites from the year set out below to October 2026.

These forms were used for a wide variety of university business, for example meeting registrations, residence applications, general surveys and many other uses.

The table below outlines the website and all the types of data that were stolen. Please note that the list of data elements is comprehensive: the full list of elements does not apply to all members of a group, and most stolen information was basic information such as York identification numbers and information.

“Health information” may include clinical information such as diagnosis and treatment. “Financial status information” may include information income and debts. "Legal/criminal background information” may simply indicate that one has no criminal background or sanction from an adjudicative or professional body.

Data stolen each population (not individuals)

Centre for Refugee Studies

Academic history, Citizenship/origin, Diet/allergy information, Disability/accommodation status, Email address, Family/third-party , Employment history, Financial status, Gender/sex, Legal/criminal background, Phone number, Street address, York identification number

Department of Psychology

Academic history, Citizenship/origin, Date of birth, Diet/allergy information, Disability/accommodation status, Email address, Family/third-party , Employment history, Gender/sex, Health information, Indigenous status, Phone number, Race/ethnicity, Religion, Sexual orientation, Street address, York identification number

Academic history, Citizenship/origin, Date of birth, Diet/allergy information, Disability/accommodation status, Email address, Family/third-party , Employment history, Financial status, Gender/sex, Health information, Images/photos, Indigenous status, Legal/criminal background, Phone number, Race/ethnicity, Sexual orientation, Street address, York identification number

Faculty of Environmental and Urban Change

Academic history, Citizenship/origin, Date of birth, Diet/allergy information, Disability/accommodation status, Email address, Family/third-party , Employment history, Financial status, Gender/sex, Health information, Images/photos, Indigenous status, Legal/criminal background, Phone number, Race/ethnicity, Street address, York identification number

Faculty of Graduate Studies

Academic history, Citizenship/origin, Date of birth, Diet/allergy information, Disability/accommodation status, Email address, Family/third-party , Employment history, Financial status, Gender/sex, Health information, Indigenous status, Legal/criminal background, Phone number, Race/ethnicity, Sexual orientation, Street address, York identification number

Faculty of Liberal Arts and Professional Studies

Academic history, Citizenship/origin, Date of birth, Diet/allergy information, Disability/accommodation status, Email address, Family/third-party , Employment history, Financial status, Gender/sex, Health information, Images/photos, Indigenous status, Legal/criminal background, Phone number, Race/ethnicity, Sexual orientation, Street address, Vaccination status, York identification number

Academic history, Citizenship/origin, Date of birth, Diet/allergy information, Disability/accommodation status, Email address, Family/third-party , Employment history, Financial status, Gender/sex, Health information, Images/photos, Indigenous status, Phone number, Race/ethnicity, Religion, Sexual orientation, Street address, Vaccination status, York identification number

Academic history, Date of birth, Disability/accommodation status, Email address, Family/third-party , Employment history, Gender/sex, Health information, Images/photos, Phone number, Street address, York identification number

Housing and Conference Services

Academic history, Date of birth, Diet/allergy information, Email address, Family/third-party , Employment history, Gender/sex, Phone number, Street address, York identification number

Lassonde School of Engineering

Academic history, Citizenship/origin, Date of birth, Diet/allergy information, Disability/accommodation status, Email address, Employment history, Family/third-party , Gender/sex, Health information, Indigenous status, Phone number, Race/ethnicity, Religion, Sexual orientation, Street address, York identification number

Research and Innovation

Academic history, Citizenship/origin, Date of birth, Diet/allergy information, Disability/accommodation status, Email address, Family/third-party , Employment history, Financial status, Gender/sex, Images/photos, Indigenous status, Phone number, Race/ethnicity, Religion, Sexual orientation, Street address, York identification number

Schulich School of Business

Academic history, Citizenship/origin, Date of birth, Diet/allergy information, Disability/accommodation status, Email address, Family/third-party , Employment history, Financial status, Gender/sex, Health information, Images/photos, Indigenous status, Legal/criminal background, Phone number, Race/ethnicity, Religion, Street address, York identification number

University Secretariat

Academic history, Date of birth, Email address, Family/third-party , Employment history, Phone number, Street address, York identification number

Vice-Provost Academic

Academic history, Disability/accommodation status, Email address, Family/third-party , Employment history, Phone number, Street address, York identification number

There are also a small number of additional affected individuals who the University will directly notify. Members of this group whose government identification information or financial account information was exposed will receive two years of complimentary TransUnion credit monitoring and identity theft protection services. These notifications will be sent by email.

The incident came to the University’s attention on October 25, 2026. York acted quickly to contain the incident and began an investigation with the assistance of external experts.

York took immediate steps to contain the incident and has been working with external experts to investigate its scope and remediate the affected systems. The investigation has found no evidence that the unauthorized actor moved beyond the affected systems or gained access to other parts of the University’s IT environment.

York has reported the privacy breach to the Information and Privacy Commissioner of Ontario and reported the incident to law enforcement. Although we expect the IPC to open a file and investigate, you are entitled to complain.

What affected individuals can do

Affected individuals should remain alert for suspicious emails, text messages and telephone calls, particularly communications asking for personal information or directing them to unfamiliar websites. We encourage affected individuals to monitor their financial accounts for unusual activity and to use strong, unique passwords and multi-factor authentication where available.

We recognize that this incident may be concerning to you. We take that seriously and regret these circumstances. The University is committed to learning from this incident and will continue to strengthen its cybersecurity posture, incident readiness, and safeguards for personal information.

Individuals with questions can [email protected]. Further information will be posted at as appropriate.

An unauthorized actor accessed some webforms used by departments of York University and took personal information submitted through those forms. York took immediate steps to contain the incident and engaged external experts to investigate.

York immediately contained the incident, investigated its scope, reported the privacy breach to the Information and Privacy Commissioner of Ontario, and reported the incident to law enforcement.

After thorough investigation, there is no evidence that the unauthorized actor moved beyond the affected systems or gained access to other parts of the University’s IT environment.

York continues to investigate. It has implemented responsive security improvements to its web forms pending further consideration.

Yes. An unauthorized actor accessed and took personal information.

No. The information affected varies from person to person. Most stolen information was basic information such as York identification numbers and information.

Review the affected groups and time periods identified in the notice above. If you fall within one of those groups, this publication serves as York’s notification that your information was affected.

York will directly notify a small number of individuals, including individuals whose government identification information or financial account information was exposed.

If you would like to know what specific types of personal information you were affected, please [email protected] . York will first need to verify your identity and then review the affected information. Given the number of individuals affected, responding to individual inquiries may take some time.

York will provide two years of complimentary TransUnion credit monitoring and identity theft protection to individuals whose government identification information or financial account information was exposed.

York encourages eligible individuals to take advantage of the service. Instructions for enrolling will be provided in the direct notification.

Identify fraud is regrettably a risk we all bear every day. Most of the stolen information is not the type of information associated with an elevated risk of such fraud. For those whose government identification or financial information was exposed, we are providing two years of complimentary TransUnion credit monitoring and identity theft protection.

Remain alert for suspicious emails, text messages and telephone calls, particularly communications asking for personal information or directing you to unfamiliar websites. Monitor your financial accounts for unusual activity and use strong, unique passwords and multi-factor authentication where available.

If you receive a direct notification with a credit monitoring offer, we encourage you to enrol.

the relevant financial institution or service provider promptly. You may also report suspected fraud to the Canadian Anti-Fraud Centre and to York.

York has implemented responsive security improvements to its web forms pending further consideration.

Further information will be posted at as appropriate.

Individuals with questions can [email protected] .