York University warns of personal data theft in cybersecurity incident

University became aware of 'an unauthorized actor' accessing departmental forms on Oct. 25

York University says it discovered last month it was subject to a cybersecurity incident that resulted in the theft of personal information, including personal details and student identification numbers.

"An unauthorized actor" gained access to online forms used by the university's departments ranging from 2007 to October this year, the Toronto institution said in a news release on its website.

The forms were used in a "wide variety of university business," including residence applications and general surveys, it said.

York University said it acted quickly to contain the information after the incident was discovered on Oct. 25, but some personal information was stolen. The university did not disclose when the incident first took place nor how long after they discovered the theft.

The school is now warning people who may be affected to watch out for suspicious emails, texts or phone calls. It urged people to monitor their financial accounts for unusual activity and to use strong passwords and multi-factor authentication when possible.

"We recognize that this incident may be concerning to you. We take that seriously and regret these circumstances," York University said. "The University is committed to learning from this incident and will continue to strengthen its cybersecurity posture, incident readiness, and safeguards for personal information."

How to know if you've been hacked — and what you can do to protect yourself

The university said it will directly some of the people impacted, including those whose financial account and government identification information was exposed.

The stolen data included academic histories, citizenship, disability and accommodation statuses, email addresses, family contacts, financial information and phone numbers. A variety of department's were affected, including the centre for refugee studies, department of psychology and faculty of graduate studies.

A full list of affected departments and the kinds of data stolen is listed on the York University website.

School provides credit, identity theft protection to some

After discovering the incident, York University began an investigation with help from outside experts to understand the scope of the issue and to regain impacted systems.

That investigation did not find evidence that other information or systems were affected by the incident.

The university has reported the incident to police and to the Information and Privacy Commissioner of Ontario, who is expected to open an investigation. York said people affected by the stolen information can also file a complaint with the commissioner.

Exclusive More than 1.5 million Canadian Crime Stoppers tips leaked, CBC exclusive finds

More than 1.5 million Canadian Crime Stoppers tips leaked, CBC exclusive finds

U of T, OCAD among Ontario universities impacted by Canvas cyber breach

U of T, OCAD among Ontario universities impacted by Canvas cyber breach

" Most of the stolen information is not the type of information associated with an elevated risk of such fraud," the university said. "Identify fraud is regrettably a risk we all bear every day."

People who had government identification and financial account information exposed will receive two years of TransUnion credit monitoring and identity theft protection, York said.

It said any suspicious activity should be reported immediately to relevant financial institutions or service providers. People also can report any issues to the Canadian Anti-Fraud Centre and to the university.

Arrthy Thayaparan is a writer at CBC Toronto with interests in health, climate, education and community stories. You can her at [email protected].

Police services across Ontario suspend use of Crime Stoppers after CBC investigation

Exclusive More than 1.5 million Canadian Crime Stoppers tips leaked, CBC exclusive finds

U of T, OCAD among Ontario universities impacted by Canvas cyber breach