The recent cybersecurity incident at York University in Canada highlights an important concern for enterprises: protecting personal information is not just about securing the applications collecting it, but also about managing how long that information remains accessible.

York University has confirmed that attackers accessed personal information submitted through online forms across 14 university websites. The affected submissions date back to 2007, potentially exposing nearly two decades of historical information.

The compromised information varies by individual and includes contact details, university identification numbers and, in some cases, government identification, health information, academic records, employment history and financial details.

What makes this incident particularly concerning is the age and sensitivity of the information involved. Data collected for an application, registration or administrative process many years ago may continue to create security and privacy risks long after that process has been completed.

For enterprises, this raises an important question: Do organisations know what personal information they are retaining, where it is stored, who can access it and whether it is still required?

Many organisations focus heavily on securing their current applications while overlooking historical databases, archived forms and older web applications that may continue to store sensitive information.

This incident reinforces the importance of data minimisation, secure data retention, application security, Data Loss Prevention (DLP), strict access controls and continuous monitoring.

Organisations must regularly review historical data, remove information that is no longer required, and ensure that retained records are protected against unauthorised access.

Equally important is monitoring unusual data-access behaviour. An authenticated user or application should not automatically be permitted to retrieve large volumes of historical information without appropriate authorisation.

The incident also highlights the need to include older applications and departmental websites in enterprise-wide security assessments.

The larger cybersecurity lesson is that protecting data must extend throughout its entire lifecycle, from collection and storage to access, retention and eventual deletion.

Because information that an organisation no longer needs can still be extremely valuable to cybercriminals.

York University has announced it suffered a cybersecurity incident in which a threat actor stole personal information people submitted through online forms. [...]

Source: York University breach exposed personal information dating to 2007 via Bleeping Computer — published 09 Nov 2026.