York University (Toronto) data breach exposes personal information submitted via 14 departmental web forms (2007-2026)

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5589 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Web Server Process Spawning Shell or Recon Tools (Form Back-End Compromise)

Detects a web server worker (w3wp, httpd, php-cgi, tomcat, nginx) spawning cmd, PowerShell, whoami, certutil, net, bitsadmin or mshta. This is the classic web-shell post-exploitation signal on a compromised form host and fits TL-2026-5589 data theft from departmental web-form back ends (T1505.003, T1059, T1190).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1505.003, T1059, T1190
• Data sources: sysmon, defender_for_endpoint, windows_process_creation
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*w3wp.exe" OR ParentImage="*httpd.exe" OR ParentImage="*php-cgi.exe" OR ParentImage="*tomcat*.exe" OR ParentImage="*nginx.exe") (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*whoami.exe" OR Image="*certutil.exe" OR Image="*net.exe" OR Image="*net1.exe" OR Image="*bitsadmin.exe" OR Image="*mshta.exe") | stats count values(CommandLine) AS commands min(_time) AS first_seen max(_time) AS last_seen BY host User ParentImage Image | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('w3wp.exe', 'httpd.exe', 'php-cgi.exe', 'nginx.exe', 'tomcat9.exe', 'tomcat10.exe')
| where FileName in~ ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'whoami.exe', 'certutil.exe', 'net.exe', 'net1.exe', 'bitsadmin.exe', 'mshta.exe')
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

Sigma

title: Web Server Process Spawning Shell or Reconnaissance Tool
id: 8c3d41f0-6b2e-4d95-a7f3-19e5c0d2b202
status: experimental
description: Detects web server worker processes spawning command interpreters or recon utilities, indicating web shell activity on a compromised web-form host (TL-2026-5589, T1505.003).
references:
  - https://www.yorku.ca/uit/infosec/incident-faq/
author: Threadlinqs Team
date: 2026/11/09
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059
  - attack.initial-access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\php-cgi.exe'
      - '\nginx.exe'
      - '\tomcat9.exe'
      - '\tomcat10.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\certutil.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Web applications that legitimately shell out to helper scripts
  - Deployment or health-check scripts launched from the web server
level: high

Known false positives:

• Web applications that legitimately invoke cmd or PowerShell helper scripts
• Scheduled health checks or deployment tooling launched under the web server process

Tuning notes: Allow-list known application-specific child command lines per host. Extend the parent list for Java application servers (java.exe running Tomcat) and for Linux hosts via auditd or Sysmon for Linux. Prioritize hosts serving the 14 affected departmental form sites.

• 🔒 Bulk Enumeration of Form Submission or Export Endpoints on [indicator] · unlock with TL Creds
• 🔒 Archive Staging of Web-Root or Database Dump Files · unlock with TL Creds
• 🔒 Phishing Lure Impersonating York University Breach Notices · unlock with TL Creds
• 🔒 Server-Side Script Requested from Upload or Attachment Directory (Web Shell) · unlock with TL Creds
• 🔒 Database Dump or Bulk Export Utility Execution (Form Data Collection) · unlock with TL Creds
• 🔒 Web Server Process Writing Archive, Dump or CSV Files · unlock with TL Creds
• 🔒 [indicator] Web Form Injection and Traversal Probing (TL-2026-5589 Exploitation) · unlock with TL Creds
• 🔒 Command-Line File Upload or Cloud-Sync Exfiltration Tooling (Form Data Theft) · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5589.

Sample indicators (1 of 13)

• Domain: yorku[.]ca

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

Technical analysis

York University (Toronto, Canada; 55,700+ students and about 7,000 administrative staff) learned on October 25, 2026 that an unauthorized actor had accessed web forms used by several university departments and exfiltrated the personal information submitted through them. Per the university's incident FAQ, the compromised forms were hosted on 14 sites: Centre for Refugee Studies (forms since 2019), Department of Psychology (2016), Division of Students (2019), Faculty of Environmental and Urban Change (2007), Faculty of Graduate Studies (2013), Faculty of Liberal Arts and Professional Studies (2013), Faculty of Science (2014), Glendon Housing (2017), Housing and Conference Services (2015), Lassonde School of Engineering (2020), Research and Innovation (2018), Schulich School of Business (2016), University Secretariat (2015) and Vice-Provost Academic (2022). Affected records run from each site's start year through October 2026.

The exposed data varies by site and individual. Categories listed by the university include email address, phone and street address, date of birth, York ID number, government ID information, third-party/family contacts, health information, academic and employment history, financial status, legal/criminal background, citizenship, gender, race/ethnicity, religion, sexual orientation, Indigenous status, disability/accommodation status, vaccination status, diet/allergy information, and photos or other images. York states most stolen records are basic (contact details and York ID numbers). The number of affected individuals has not been disclosed.

How the actor gained access has not been disclosed; York says the cause remains under investigation, that it found no evidence the actor moved beyond the affected systems or into other parts of its IT environment, and that it contained the incident, engaged external experts, reported the breach to the Information and Privacy Commissioner of Ontario (IPC) and to law enforcement, and implemented security improvements to its web forms. Individuals whose government ID or financial account information was exposed are being notified directly by email and offered two years of TransUnion credit monitoring and identity theft protection. BleepingComputer found no ransomware group claiming the attack and no perpetrator has been named. No technical indicators of compromise (IPs, domains, hashes) have been published.

Defensive relevance: long-retained form submissions on departmental web properties (some 19 years old) concentrated sensitive data with weak lifecycle controls. The stolen data supports targeted phishing, social engineering and identity fraud against students, applicants, staff and research participants, including members of vulnerable groups (refugee studies, psychology research, housing applicants). MITRE mappings below are low-confidence and inferred from the nature of the incident (web-form data theft); the vector itself is unconfirmed.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Initial Access

T1190 Exploit Public-Facing Application; T1566 Phishing

Remediation

Immediate actions

• Affected individuals: watch for suspicious emails, texts and calls requesting personal information or linking to unfamiliar sites; York will never ask for passwords, SIN, banking details or full credit card numbers
• Monitor financial accounts for unusual activity; report suspected fraud to the Canadian Anti-Fraud Centre and to York
• Enrol in the complimentary TransUnion credit monitoring if a direct notice was received
• Contact incident@yorku.ca (identity verification required) to learn which data about you was exposed

Workarounds

• York has implemented security improvements to the affected web forms pending further review and states the forms are secure to use

Longer-term hardening

• Institutions: inventory departmental web forms and apply data-retention limits so historic submissions are not kept indefinitely
• Minimise collection of government ID, health and criminal-background data in web forms; store sensitive fields encrypted and separate from the web tier
• Monitor web-form back ends for bulk reads/exports and unusual admin or database access
• Use strong unique passwords and multi-factor authentication

Affected and fixed versions

• York University — Departmental online forms on 14 university websites
  Vulnerable versions: Form submissions 2007-October 2026 (earliest: Faculty of Environmental and Urban Change, 2007)
  Fixed in: Security improvements to web forms implemented; cause under investigation

Timeline

• 2007-01-01 Earliest affected form data: Faculty of Environmental and Urban Change forms date from 2007 (year only stated by York; day/month approximate)
• 2016-01-01 Department of Psychology and Schulich School of Business forms begin (year only stated); other affected sites start between 2013 and 2022
• 2022-01-01 Vice-Provost Academic forms begin, the most recent of the 14 affected sites (year only stated)
• 2026-10-25 York engages external experts, reports the breach to the Ontario IPC and law enforcement, and hardens web forms (exact dates not stated; sequence follows discovery)
• 2026-10-25 York University learns of unauthorized access to departmental web forms and takes containment action; forms affected through October 2026
• 2026-11-09 BleepingComputer reports the breach; York's public notice lists the 14 sites, data types, and two years of credit monitoring for those with government ID or financial data exposed

Sources cited

• Information and Privacy Commissioner of Ontario (regulator notified of the breach) ipc.on.ca · Advisory
• Canadian Anti-Fraud Centre (reporting channel recommended by York) antifraudcentre-centreantifraude.ca · Advisory
• York University Cybersecurity Incident FAQ (affected websites, data types, response) yorku.ca · Vendor report
• York University Information Security (UIT InfoSec) updates yorku.ca · Vendor report
• York University breach exposed personal information dating to 2007 BleepingComputer · News · 2026-11-09

More in data breach

• Baker Tilly Advisory Group client data breach via unnamed third-party service provider platform
• Railway cloud platform breach exposes customer secrets, leads to $740,000 in fraudulent AI charges (Wiz 'Black October' campaign)
• NEAR AI breach via SGLang remote code execution exposes ~100 user accounts and 18 legacy AI agents
• BYOD Ransomware Group Allegedly Claims Toyota Data Breach (Unverified)
• Binance denies data breach after alleged ShinyHunters-branded data sale claim (335M user records)