---
id: "CMP-202611-2x23ij"
page: "https://infrastack.ai/live/CMP-202611-2x23ij"
kind: "campaign"
aliases: []
title: "York University (Toronto) breached: personal data submitted through web forms on 14 university sites since 2007 stolen, including ID, health and financial details"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: "2026-11-09T00:00:00+00:00"
first_seen_at: "2026-11-09T21:40:33+00:00"
updated_at: "2026-11-09T21:40:43+00:00"
sources: [{"source": "analyst", "url": "https://www.bleepingcomputer.com/news/security/york-university-breach-exposed-personal-information-dating-to-2007/", "first_seen_at": "2026-11-09T21:40:33+00:00", "cites": ["https://www.bleepingcomputer.com/news/security/york-university-breach-exposed-personal-information-dating-to-2007/"]}]
exploit_sources: []
---

# York University (Toronto) breached: personal data submitted through web forms on 14 university sites since 2007 stolen, including ID, health and financial details

Link for people: https://infrastack.ai/live/CMP-202611-2x23ij (this .md is for agents)

York University in Toronto confirmed that attackers stole personal information from departmental web forms. It found the unauthorized access on 25 Oct 2026. The stolen forms were submitted to 14 university websites between 2007 and 2026, so current and former students, staff, applicants and others who filled them in may be affected. Most records hold contact details and York ID numbers. Some also hold date of birth, government ID details, third-party contacts, health, academic, employment and financial status, criminal background, demographics and photos. Number of people affected: not disclosed. Attacker: unknown, and no ransomware group has claimed it. York says the forms are now secure.

_Summary, check and fix written by a model from the sources; labelled as such._

## Cause

How the attacker got in: not disclosed yet (unknown). The record says York confirmed attackers stole personal information from departmental web forms but does not say how they got in, and warns users to expect phishing or scam calls that cite their York ID or personal details.

How it reached others: their users got messages abusing it (phishing).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#phishing

## How to check

You (or your staff) ever submitted a York University departmental web form (2007-2026). Watch for a notification from York University; those with government ID or financial information exposed are being contacted directly. Expect phishing or calls posing as York University or as credit-monitoring offers that use your York ID or personal details; specific lure domains or subjects: unknown.

## Fix

If notified, enrol in the two years of credit monitoring and identity theft protection York offers. If not notified, contact York University to ask what of your data was exposed. Be wary of unexpected messages that cite your York ID or personal details, and confirm through York's official site. If government ID data was exposed, consider a credit freeze or fraud alert.

## Timeline

- 2026-11-09T21:40:33+00:00 analyst https://www.bleepingcomputer.com/news/security/york-university-breach-exposed-personal-information-dating-to-2007/

## Documents

- [describes] @BleepinComputer: York University breach exposed personal information dating to 2007
https://t.co/ https://x.com/BleepinComputer/status/2119903556656345508
- [describes] BleepingComputer: York University breach exposed personal information dating to 2007 https://www.bleepingcomputer.com/news/security/york-university-breach-exposed-personal-information-dating-to-2007/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_