York University says it discovered last month it was subject to a cybersecurity incident that resulted in the theft of personal information, including personal contact details and student identification numbers.
“An unauthorized actor” gained access to online forms used by the university’s departments ranging from 2007 to October this year, the Toronto institution said in a news release on its website. The forms were used in a “wide variety of university business,” including residence applications and general surveys, it said.
York University said it acted quickly to contain the information after the incident was discovered on Oct. 25, but some personal information was stolen. The university did not disclose when the incident first took place nor how long after they discovered the theft.
The school is now warning people who may be affected to watch out for suspicious emails, texts or phone calls. It urged people to monitor their financial accounts for unusual activity and to use strong passwords and multi-factor authentication when possible.
“We recognize that this incident may be concerning to you. We take that seriously and regret these circumstances,” York University said. “The University is committed to learning from this incident and will continue to strengthen its cybersecurity posture, incident readiness, and safeguards for personal information.”
The impacted forms were not tied to the university’s primary systems, such as applications, human resources or student systems, said York’s deputy spokesperson Yanni Dagonas.
How to know if you’ve been hacked — and what you can do to protect yourself
The university contacted some of the people impacted, including those whose “financial account and government identification information” was exposed.
Dagonas did not say how many people’s financial account and government identification information was stolen, other than to say it was a small number.
“The university takes its responsibility to protect the privacy and security of its community seriously,” he said, adding “responsive security improvements” have been added to the web forms for departments.
The stolen data included academic histories, citizenship, disability and accommodation statuses, email addresses, family contacts, financial information and phone numbers. A variety of department’s were affected, including the centre for refugee studies, department of psychology and faculty of graduate studies.
A full list of affected departments and the kinds of data stolen is listed on the York University website.
People who had government identification and financial account information exposed were offered two years of complimentary TransUnion credit monitoring and identity theft protection, Dagonas said.
After discovering the incident, York University began an investigation with help from outside experts to understand the scope of the issue and to regain impacted systems.
That investigation did not find evidence that other information or systems were affected by the incident.
The university has reported the incident to police and to the Information and Privacy Commissioner of Ontario, who is expected to open an investigation. York said people affected by the stolen information can also file a complaint with the commissioner.
More than 1.5 million Canadian Crime Stoppers tips leaked, CBC exclusive finds
U of T, OCAD among Ontario universities impacted by Canvas cyber breach
“Most of the stolen information is not the type of information associated with an elevated risk of such fraud,” the university said. “Identify fraud is regrettably a risk we all bear every day.”
It said any suspicious activity should be reported immediately to relevant financial institutions or service providers. People also can report any issues to the Canadian Anti-Fraud Centre and to the university.
