York University is investigating the theft of personal information submitted through online forms on some of its websites, according to CityNews reporting that includes material from The Canadian Press.

The university said an unauthorized actor accessed information belonging to people who completed forms, including residence applications and surveys, between 2007 and October 2026. That date range describes the records affected, not how long the unauthorized access lasted.

The incident was limited to a specific list of websites and faculties identified on the university’s website, the school said. Investigators have found no evidence that the unauthorized actor accessed other parts of the university.

A small number of affected people had government identification or financial account information exposed, according to the school. The supplied report does not give a total number of people affected.

York said it began investigating with external experts after discovering the breach last month. The incident has been reported to law enforcement and the Information and Privacy Commissioner of Ontario.

The university said affected individuals will be contacted directly. It urged them to watch for suspicious emails, text messages and phone calls, especially those requesting personal information or directing recipients to unfamiliar websites, and to monitor their financial accounts.

People whose government identification or financial information was exposed are being offered two years of complimentary TransUnion credit monitoring and identity theft protection.

“We take that seriously and regret these circumstances,” the university said.

Sources