York University Reports Cybersecurity Breach Involving Departmental Online Forms
York University disclosed a cybersecurity incident discovered on October 25 in which an unauthorized actor accessed departmental online forms used between 2007 and October of this year, exposing personal information including contact details, student IDs, academic histories, and financial data for a small number of individuals.
York University became aware of a cybersecurity incident on Oct. 25 after discovering that an unauthorized actor had accessed online forms used by various university departments. The compromised forms were in use from 2007 until October of the current year for purposes such as residence applications and general surveys.
The stolen data included personal contact details, student identification numbers, academic histories, citizenship status, disability and accommodation statuses, email addresses, family contacts, financial information, and phone numbers. A small number of people had their financial account and government identification information exposed in the breach.
Affected departments include the Centre for Refugee Studies, the Department of Psychology, and the Faculty of Graduate Studies. The impacted forms were not tied to the university's primary systems, such as applications, human resources, or student systems. An investigation conducted with outside experts did not find evidence that other information or systems were affected by the incident.
Individuals whose financial account and government identification information was exposed have been offered two years of complimentary TransUnion credit monitoring and identity theft protection. York University reported the incident to police and the Information and Privacy Commissioner of Ontario, who is expected to open an investigation.