York University has confirmed the theft of information from departmental forms, reported by BleepingComputer on November 9, 2026. People who completed older forms should examine the published scope even if they no longer study in Toronto.
Forms spanning many years
BleepingComputer identifies fourteen websites, with records dating back as far as 2007 for some departments. Residence applications, meeting registrations and surveys do not represent the same file. Assess exposure using the form and time period involved rather than assuming all university information was accessible.
Categories vary between individuals
York’s official notice says most stolen information consists of contact details and York identification numbers. Depending on the form, the data can also include medical diagnoses or treatments, disability status and financial information. York’s table describes categories across each population, not a complete stolen profile for every individual. To establish your situation, use the contact on York’s official page and ask which categories apply to you, without volunteering identity documents to an address received in a message.
Check even without a personal email
York says the publication serves as notification for the groups listed. Some people, including those with exposed government identification or financial account information, will be contacted directly and can receive two years of TransUnion monitoring. The absence of an email therefore does not place you outside the scope.
Plan a response around your own record
The Canadian Press reports an investigation involving outside experts. Our recommendation for former students is to start from a bookmarked York page rather than a message promising data removal. Retain notifications and distinguish legitimate university enquiries from callers requesting secrets.
University departments and small organizations using forms can ask a practical question prompted by the age of these records: which information still needs to remain accessible in each old form? Inventory exports, owners and retention periods before deciding on deletion in line with your obligations.
The link with Soclyde
Soclyde keeps passwords in an encrypted vault on the user’s devices. Separate secrets for email and university services reduce reuse. The vault does not remove answers already submitted to York or remedy exposure of contact or health information.
Takeaways
Compare your past use with the notice’s periods and request an individual scope if needed. If you also gave a secret to fake support, our hacked password response guide helps organize account recovery with its provider.
