Nineteen Years of Forms. One Breach Took Them.

Every form a university collects feels harmless in the moment: an email address here, a phone number there, a date of birth for the record. York University in Toronto has just learned what happens when nineteen years of those forms end up in the wrong hands. The school has confirmed that an intruder accessed personal information submitted through online forms on 14 of its websites — forms reaching all the way back to 2007.

The unauthorized access was discovered on October 25. York, which has more than 55,700 students and about 7,000 staff, says it contained the incident quickly — but not before personal information was stolen.

Far more than names and emails

The university’s disclosure lists what the affected forms held, and it goes well beyond contact details. Depending on which form a person filled out, the exposed data can include email addresses and phone numbers, dates of birth, York identification numbers, government ID information, and third-party contact details. Some forms held health information, academic history, and employment history. Others held financial status, criminal background information, demographic details, and photos.

York is quick to add context: most of the stolen records contained basic contact information and York ID numbers, and the exact mix varies from person to person. But the categories at the deep end of that list — government IDs, health details, financial status — are precisely the ingredients that make identity theft and targeted phishing work. It is the same pattern seen when a suspicious file exposed 7.7 million shoppers’ details at Iris Ohyama: the raw count matters less than how usable the data is.

Nineteen years is a long memory

The striking number in this breach is not a headcount — York has not said how many people are affected. It is the date range. Forms submitted between 2007 and 2026 were in reach, which means the exposed population is not just current students. It includes alumni who graduated a decade ago, applicants who never enrolled, employees long gone, and anyone who ever sent details to a departmental web page and forgot about it.

That is the quiet risk in every long-lived web form: data collected for a one-time purpose tends to stay exactly where it was collected, on systems nobody revisits, long after its usefulness ends. Retention is a decision, even when nobody remembers making it.

There is an institutional lesson here, and it is not really about firewalls. Old forms are rarely reviewed, rarely pruned, and often reachable through the same public websites they were collected on. A retention schedule that deletes application data a few years after it stops being useful would have shrunk this breach by a decade or more. Data you no longer hold is data nobody can steal from you.

Who hears from York, and who has to ask

York says the affected website forms are now secure and safe to use. The university will directly notify individuals whose government ID or financial account information was exposed, and offer them two years of credit monitoring and identity theft protection.

Everyone else is in the harder position: if you did not get a notification, the university invites you to contact it directly to learn what data of yours was exposed. In other words, the people with the most dangerous data in play get a letter and protection; everyone else gets homework. That mirrors the response structure in the Norad grants portal breach, where notification and follow-up did much of the real work after the fact.

No ransomware group has claimed the attack, and York has not described how the intruder got in.

If you ever filled out one of those forms

Treat “York” emails with suspicion. Contact details plus academic and employment history make convincing phishing easy. Go to the university’s site directly instead of clicking links in messages about the breach.

Watch the accounts that matter. If your government ID or financial details were involved, take the credit monitoring offer, and consider a credit freeze — it is free and stronger than monitoring alone.

Ask what was taken. If you submitted forms to York any time since 2007 and hear nothing, use the university’s contact route. You cannot protect data you do not know is out there.

Reuse nothing. If any password or security answer was based on details in those forms — dates, schools, employers — change it. Nineteen years of forms is a lot of answers to common recovery questions.