York University Formulários web da York… · Breach

York University confirms breach of web form data dating to 2007

Nov 09, 2026 · 1 min read

Hackers stole years of personal data from web forms at York University, one of Canada's biggest, including health details, sexual orientation and disability status. The forms span 14 departments, with submissions dating back to 2007, and some people lost government ID or financial-account details. York found the break-in on 25 October, reported it to Ontario's privacy commissioner and police, and says it found no sign the hackers got beyond the affected forms.

By HIFY Radar newsroom Updated 11/09/2026 04:46 AM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Alleged

Hackers stole years of personal data submitted through web forms at York University, one of Canada's largest universities, according to security outlet IntCyberDigest. The affected forms spanned 14 departments, and some submissions date back to 2007.

Alleged

The stolen material reportedly includes health details, sexual orientation and disability status, while York says most of the data was basic contact information. The university discovered the intrusion on 25 October and has not said how many people are affected; it has reported the breach to Ontario's privacy commissioner and to police.

What happened

Alleged

Attackers compromised web forms at York University that ranged from residence applications to surveys, spanning 14 departments. Some of the exposed submissions date back to 2007, implying years of accumulated personal data was taken in a single breach.

Alleged

York's Centre for Refugee Studies was among the affected units, with breached forms holding citizenship and financial details. Some individuals also had government ID or financial-account details exposed, according to the report.

Observed

York says it found the break-in on 25 October and has not disclosed how many people are affected. The university has reported the incident to Ontario's privacy commissioner and to police.

Why it matters

Inferred

The reported data categories: health details, sexual orientation and disability status: are among the most sensitive classes of personal information, and their exposure can enable discrimination, extortion or targeted harassment of affected individuals.

Inferred

The compromise of the Centre for Refugee Studies' forms, which held citizenship and financial details, heightens the risk profile: refugee applicants are a vulnerable population for whom exposure of citizenship or financial information can have serious consequences.

Observed

York University has published an official incident FAQ page on its information security site, acknowledging the incident publicly and providing a university-side account of events.

What to do

Observed

Members of the York University community can consult the university's published incident FAQ page for official information about the breach and any guidance the institution has issued.

Inferred

Because some individuals reportedly had government ID or financial-account details exposed, anyone who submitted a York web form over the past years should monitor financial statements and account activity, and be alert to follow-on phishing that may reference the breach.

Confirmed and still uncertain

Observed

Known: the breach was discovered on 25 October; it affected web forms across 14 departments with submissions dating back to 2007; the Centre for Refugee Studies was hit; some government ID and financial-account details were exposed; and York has notified Ontario's privacy commissioner and police.

Inferred

Unknown: York has not said how many people are affected. The available evidence also does not describe how the attackers got in, how long they had access, or who is behind the breach, leaving the attack vector and attribution open questions.

What people are saying

Alleged

York University says most of the stolen data was basic contact information, downplaying the sensitivity of the exposed material.

Alleged

York also says it has found no sign that the hackers got beyond the affected forms, suggesting the intrusion was contained to the breached web forms.

Contested

The characterization of the stolen data is contested: IntCyberDigest's reporting highlights highly sensitive categories such as health details, sexual orientation and disability status, while York maintains that most of the data was basic contact information.

Evolution

Observed

The exposed data accumulated over a long period: some form submissions date back to 2007, meaning nearly two decades of records were sitting in the affected web forms when they were compromised.

Observed

The known timeline of the incident itself is short: York discovered the break-in on 25 October, and subsequently reported the breach to Ontario's privacy commissioner and to police. No further developments appear in the current evidence batch.

Reach

Observed

4 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The compromise affected web forms: including residence applications and surveys: across 14 university departments. The evidence batch does not describe the technical vector used to breach the forms.

Alleged

York states that its investigation found no sign the hackers got beyond the affected forms, which, if accurate, would suggest the attackers did not pivot into other university systems.

Inferred

No technical indicators of compromise, malware details or threat-actor attribution appear anywhere in the available evidence, so the intrusion method and perpetrator remain undescribed.

Sources and evidence

Observed

This item is based on two posts by IntCyberDigest on X relaying the breach details, along with the outlet's newsletter and Telegram channel, which are listed as primary distribution sources for the reporting.

Inferred

York University's official incident FAQ page is listed as a primary source, but its content was not included in this evidence batch; accordingly, all statements attributed to York in this item come via IntCyberDigest's reporting and should be treated as allegations pending direct confirmation.