York University breach exposes 19 years of sensitive student and staff data

York University in Toronto has confirmed a significant data breach where an attacker accessed personal information submitted through online university forms. The breach, discovered on October 25, affects forms across 14 university websites spanning submissions from 2007 to 2026, exposing a vast trove of sensitive data including contact information, government IDs, health records, academic history, and financial status.

For the university's 55,700 students and 7,000 staff members, this breach creates serious risks of identity theft, phishing attacks, and social engineering. While the university claims the forms are now 'secure' and offers two years of credit monitoring to those with government ID or financial data exposed, the 19-year span of vulnerable data means many alumni and former employees may be unaware their information was compromised. This incident highlights the critical need for institutions to audit and secure historical data archives, not just current systems.

What to do: Check if you received a notification from York University, and if not, contact the university directly to learn what specific types of your data were exposed.