York University says breach exposed personal data from online forms dating back to 2007
Affected people whose government ID or financial account details were taken will be contacted and offered two years of credit monitoring.
York University in Toronto disclosed that an intruder reached personal data collected through online forms on 14 of its websites, with the access discovered on October 25. The forms in question held submissions dating back to 2007 through 2026, and the exposed fields range from contact details and York ID numbers to health, financial and government ID information. The university says the forms are now secured and will contact anyone whose government ID or financial account data was taken, offering two years of credit monitoring and identity theft protection. It has not said how many people were affected, has not named the attackers, and no ransomware group had claimed the attack at the time of reporting. For developers and operators, the case is a reminder that forms collecting sensitive records remain a valuable target, and that exposed contact information raises the risk of follow-on phishing.
Why it matters
The breach shows that online forms collecting sensitive records, such as health, financial and government ID information, remain a target for intruders. For the people whose data was taken, the exposure spans nearly two decades of submissions, and the university has not yet said how many were affected. Exposed contact details also raise the risk of follow-on phishing, which means affected individuals should expect more targeted scam attempts.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.