A ransom was paid to hackers after personal details of University of York staff and students were stolen.
The American company Blackbaud, which manages the data for the university, has confirmed that it has been the victim of a cyber attack.
The university asked Blackbaud why it didn't confirm the hack, which happened in May until July 16th.
Blackbaud said that "the cybercriminal was unable to remove a copy of a subset of data from customers", including the University of York.
He assured the university that bank or credit information was not stolen in the hacking.
- Other stories across Yorkshire
University officials said they "work with Blackbaud to understand why there has been a delay between them in finding the violation and alerting us, as well as what actions they have taken to increase their security."
On July 16, Blackbaud also informed the university that he had paid the ransom.
The university informed the Office of the Information Commissioner of the violation and said it "awaited further guidance".
Stolen details include names, gender, dates of birth, addresses and contact details along with phone numbers and email addresses.
Hackers also had access to professional details of staff and students, including for those who work now.
The university said in a statement: "We take data protection obligations very seriously and have launched our investigations, providing information for those affected who outline the steps we are taking in response.
"The third-party provider, Blackbaud, confirmed that his investigation revealed that no encrypted information, such as bank account details or passwords, was accessible."
The information commissioner's office said: "People have the right to expect organizations to manage their personal information safely and responsibly.
"The University of York has reported an incident to us and we will ask questions."
Follow BBC Yorkshire on Facebook, chirping is Instagram. Submit your story ideas to [email protected] or post videos here.
