# York University (Toronto) data breach exposes personal information submitted via 14 departmental web forms (2007-2026)

> York University confirmed that an unauthorized actor accessed limited online forms used by university departments and stole the personal information submitted through them. Affected forms span 14 university websites, with submissions dating from as early as 2007 through October 2026; the initial vector is still under investigation and no attribution or ransomware claim has been reported.

- **Published:** 2026-11-09T21:45:43Z
- **Last reviewed:** 2026-11-09T21:45:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5589
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5589.png
- **ID:** TL-2026-5589
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (1 shown free below)

## Description

York University (Toronto, Canada; 55,700+ students and about 7,000 administrative staff) learned on October 25, 2026 that an unauthorized actor had accessed web forms used by several university departments and exfiltrated the personal information submitted through them. Per the university's incident FAQ, the compromised forms were hosted on 14 sites: Centre for Refugee Studies (forms since 2019), Department of Psychology (2016), Division of Students (2019), Faculty of Environmental and Urban Change (2007), Faculty of Graduate Studies (2013), Faculty of Liberal Arts and Professional Studies (2013), Faculty of Science (2014), Glendon Housing (2017), Housing and Conference Services (2015), Lassonde School of Engineering (2020), Research and Innovation (2018), Schulich School of Business (2016), University Secretariat (2015) and Vice-Provost Academic (2022). Affected records run from each site's start year through October 2026.

The exposed data varies by site and individual. Categories listed by the university include email address, phone and street address, date of birth, York ID number, government ID information, third-party/family contacts, health information, academic and employment history, financial status, legal/criminal background, citizenship, gender, race/ethnicity, religion, sexual orientation, Indigenous status, disability/accommodation status, vaccination status, diet/allergy information, and photos or other images. York states most stolen records are basic (contact details and York ID numbers). The number of affected individuals has not been disclosed.

How the actor gained access has not been disclosed; York says the cause remains under investigation, that it found no evidence the actor moved beyond the affected systems or into other parts of its IT environment, and that it contained the incident, engaged external experts, reported the breach to the Information and Privacy Commissioner of Ontario (IPC) and to law enforcement, and implemented security improvements to its web forms. Individuals whose government ID or financial account information was exposed are being notified directly by email and offered two years of TransUnion credit monitoring and identity theft protection. BleepingComputer found no ransomware group claiming the attack and no perpetrator has been named. No technical indicators of compromise (IPs, domains, hashes) have been published.

Defensive relevance: long-retained form submissions on departmental web properties (some 19 years old) concentrated sensitive data with weak lifecycle controls. The stolen data supports targeted phishing, social engineering and identity fraud against students, applicants, staff and research participants, including members of vulnerable groups (refugee studies, psychology research, housing applicants). MITRE mappings below are low-confidence and inferred from the nature of the incident (web-form data theft); the vector itself is unconfirmed.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1566 Phishing

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Web Server Process Spawning Shell or Recon Tools (Form Back-End Compromise)** (`TL-2026-5589-SPL-002`)

Detects a web server worker (w3wp, httpd, php-cgi, tomcat, nginx) spawning cmd, PowerShell, whoami, certutil, net, bitsadmin or mshta. This is the classic web-shell post-exploitation signal on a compromised form host and fits TL-2026-5589 data theft from departmental web-form back ends (T1505.003, T1059, T1190).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1505.003, T1059, T1190
- **Data sources:** sysmon, defender_for_endpoint, windows_process_creation
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*w3wp.exe" OR ParentImage="*httpd.exe" OR ParentImage="*php-cgi.exe" OR ParentImage="*tomcat*.exe" OR ParentImage="*nginx.exe") (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*whoami.exe" OR Image="*certutil.exe" OR Image="*net.exe" OR Image="*net1.exe" OR Image="*bitsadmin.exe" OR Image="*mshta.exe") | stats count values(CommandLine) AS commands min(_time) AS first_seen max(_time) AS last_seen BY host User ParentImage Image | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('w3wp.exe', 'httpd.exe', 'php-cgi.exe', 'nginx.exe', 'tomcat9.exe', 'tomcat10.exe')
| where FileName in~ ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'whoami.exe', 'certutil.exe', 'net.exe', 'net1.exe', 'bitsadmin.exe', 'mshta.exe')
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: Web Server Process Spawning Shell or Reconnaissance Tool
id: 8c3d41f0-6b2e-4d95-a7f3-19e5c0d2b202
status: experimental
description: Detects web server worker processes spawning command interpreters or recon utilities, indicating web shell activity on a compromised web-form host (TL-2026-5589, T1505.003).
references:
  - https://www.yorku.ca/uit/infosec/incident-faq/
author: Threadlinqs Team
date: 2026/11/09
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059
  - attack.initial-access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\php-cgi.exe'
      - '\nginx.exe'
      - '\tomcat9.exe'
      - '\tomcat10.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\certutil.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Web applications that legitimately shell out to helper scripts
  - Deployment or health-check scripts launched from the web server
level: high
```

**Known false positives:**

- Web applications that legitimately invoke cmd or PowerShell helper scripts
- Scheduled health checks or deployment tooling launched under the web server process

**Tuning notes:** Allow-list known application-specific child command lines per host. Extend the parent list for Java application servers (java.exe running Tomcat) and for Linux hosts via auditd or Sysmon for Linux. Prioritize hosts serving the 14 affected departmental form sites.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Bulk Enumeration of Form Submission or Export Endpoints on [indicator] (locked: unlock with TL Creds)
- Archive Staging of Web-Root or Database Dump Files (locked: unlock with TL Creds)
- Phishing Lure Impersonating York University Breach Notices (locked: unlock with TL Creds)
- Server-Side Script Requested from Upload or Attachment Directory (Web Shell) (locked: unlock with TL Creds)
- Database Dump or Bulk Export Utility Execution (Form Data Collection) (locked: unlock with TL Creds)
- Web Server Process Writing Archive, Dump or CSV Files (locked: unlock with TL Creds)
- [indicator] Web Form Injection and Traversal Probing (TL-2026-5589 Exploitation) (locked: unlock with TL Creds)
- Command-Line File Upload or Cloud-Sync Exfiltration Tooling (Form Data Theft) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 13)

Defanged, TLP:CLEAR.

- Domain: `yorku[.]ca`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [York University breach exposed personal information dating to 2007](https://www.bleepingcomputer.com/news/security/york-university-breach-exposed-personal-information-dating-to-2007/)
- [York University Cybersecurity Incident FAQ (affected websites, data types, response)](https://www.yorku.ca/uit/infosec/incident-faq/)
- [Information and Privacy Commissioner of Ontario (regulator notified of the breach)](https://www.ipc.on.ca/)
- [Canadian Anti-Fraud Centre (reporting channel recommended by York)](https://antifraudcentre-centreantifraude.ca/)
- [York University Information Security (UIT InfoSec) updates](https://www.yorku.ca/uit/infosec/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5589