York University warns of personal data theft in cybersecurity incident
University became aware of 'an unauthorized actor' accessing departmental forms on Oct. 25
York University says it discovered last month it was subject to a cybersecurity incident that resulted in the theft of personal information, including personal contact details and student identification numbers.
asserted
that → warn → details
"An unauthorized actor" gained access to online forms used by the university's departments ranging from 2007 to October this year, the Toronto institution said in a news release on its website.
asserted
institution → gain → website
The forms were used in a "wide variety of university business," including residence applications and general surveys, it said.
asserted
it → use → applications
York University said it acted quickly to contain the information after the incident was discovered on Oct. 25, but some personal information was stolen.
asserted
information → say → Oct.
The university did not disclose when the incident first took place nor how long after they discovered the theft.
asserted
they → disclose → theft
The school is now warning people who may be affected to watch out for suspicious emails, texts or phone calls.
uncertain
who → warn → emails
It urged people to monitor their financial accounts for unusual activity and to use strong passwords and multi-factor authentication when possible.
asserted
It → urge → passwords
"We recognize that this incident may be concerning to you.
uncertain
incident → recognize → you
We take that seriously and regret these circumstances," York University said.
asserted
University → take → circumstances
"The University is committed to learning from this incident and will continue to strengthen its cybersecurity posture, incident readiness, and safeguards for personal information.
asserted
University → commit → information
"
The impacted forms were not tied to the university's primary systems, such as applications, human resources or student systems, said York's deputy spokesperson Yanni Dagonas.
asserted
spokesperson → impact → applications
The university contacted some of the people impacted, including those whose "financial account and government identification information" was exposed.
asserted
account → contact → those
Dagonas did not say how many people's financial account and government identification information was stolen, other than to say it was a small number.
"
asserted
it → say → ?
The university takes its responsibility to protect the privacy and security of its community seriously," he said, adding "responsive security improvements" have been added to the web forms for departments.
asserted
improvements → take → departments
The stolen data included academic histories, citizenship, disability and accommodation statuses, email addresses, family contacts, financial information and phone numbers.
asserted
data → steal → histories
A variety of department's were affected, including the centre for refugee studies, department of psychology and faculty of graduate studies.
asserted
variety → affect → studies
A full list of affected departments and the kinds of data stolen is listed on the York University website.
asserted
list → affect → website
People who had government identification and financial account information exposed were offered two years of complimentary TransUnion credit monitoring and identity theft protection, Dagonas said.
asserted
Dagonas → have → monitoring
School provides credit, identity theft protection to some
asserted
School → provide → some
After discovering the incident, York University began an investigation with help from outside experts to understand the scope of the issue and to regain impacted systems.
asserted
University → discover → systems
That investigation did not find evidence that other information or systems were affected by the incident.
asserted
information → find → incident
The university has reported the incident to police and to the Information and Privacy Commissioner of Ontario, who is expected to open an investigation.
asserted
who → report → investigation
York said people affected by the stolen information can also file a complaint with the commissioner.
asserted
people → say → commissioner
- Exclusive
More than 1.5 million Canadian Crime Stoppers tips leaked, CBC exclusive finds
asserted
exclusive → leak → ?
U of T, OCAD among Ontario universities impacted by Canvas cyber breach
asserted
U → impact → breach
"Most of the stolen information is not the type of information associated with an elevated risk of such fraud," the university said.
asserted
university → steal → fraud
"Identify fraud is regrettably a risk we all bear every day."
asserted
we → identify → fraud
It said any suspicious activity should be reported immediately to relevant financial institutions or service providers.
asserted
activity → say → institutions
People also can report any issues to the Canadian Anti-Fraud Centre and to the university.
asserted
People → report → university
The Aporia
