BLOG POST
York University breach exposes years of data held in departmental forms
Jawed Ahmad ·
York University says an unauthorized actor accessed departmental web forms and stole personal information submitted through them. The university learned of the incident on October 25. TorontoToday reported the scope on November 7, including exposure of government identification or financial account information for a smaller group. York’s public notice lists affected submissions on one departmental site dating back to 2007. York University incident notice · TorontoToday reporting
What York disclosed
York says most of the stolen information consisted of identifiers and contact details. Its notice also lists categories such as health and disability information across some affected departments. The categories vary by site and individual. York says it is notifying affected people and offering two years of credit monitoring and identity theft protection to the smaller group whose government identification or financial account information was exposed. York University incident notice
What remains unknown
York says its investigation found no evidence that the actor moved beyond the affected systems. The university’s public notice does not identify the initial access method, and TorontoToday reported that York did not provide a count of affected people. The dates in the notice describe when people submitted forms. They do not establish when the attacker first gained access. York University incident notice · TorontoToday reporting
What security teams can check
Inventory the data behind each form. Start with public forms that collect identity documents, financial details or health information. Record the business owner, the oldest submission still held, and every destination that receives a copy. Follow one test submission through the form platform, notification mailbox and any downstream system or export. A form that has disappeared from the website can still have submissions accessible through its administrative interface.
Test deletion in each destination. Ask the owner to identify why the data is still needed and how long it must be kept. Verify that the retention rule removes eligible submissions and attachments, and separately check the expiry of exports and backups. Coordinate cleanup with incident responders where evidence preservation is required.
Check whether logs can support a breach investigation. Verify that the form platform records privileged logins, bulk exports and API access to submissions. Run a controlled export and confirm that investigators can identify the account, time and dataset involved. York’s notice describes the exposure by department and submission period. Knowing those boundaries in advance can help responders work out who may need to be notified. York University incident notice