The Hospital for Sick Children (SickKids) has disclosed that the personal information of some current and former employees, as well as job applicants, was exposed in a “cybersecurity incident.” The hospital says the breach stemmed from a flaw in third-party software.
Clinical systems and patient records were untouched, according to the Toronto pediatric hospital, but its public-facing Careers website was temporarily pulled offline.
Careers site restored, incident scope under review
SickKids disclosed the incident this week, saying it resulted in unauthorized access to employee data.
The hospital attributes the breach to a vulnerability in a third-party software application that it says is used by SickKids and other organizations, according to a media statement.
The framing appears to suggest that there’s a wider campaign against users of the same product, although the hospital has not named the vendor, the application, or the CVE involved.
The external Careers website was temporarily affected and has “since been safely restored,” per the statement.
Clinical systems and patient information were not affected, and patient care continued as usual, SickKids says.
After learning of the incident, the hospital launched an investigation with the help of outside cybersecurity experts.
The findings indicate that personal information belonging to current and former SickKids, Boomerang (a SickKids-owned pediatric clinic), and SickKids Foundation employees, as well as SickKids job applicants, may have been exposed.
The hospital has not said what categories of data were involved, how many people are affected, or when the intrusion took place.
Its review of the impacted information is ongoing, with individuals confirmed as affected to be notified directly.
In the meantime, SickKids says it has alerted everyone potentially caught up in the incident out of an abundance of caution, and is offering 24 months of complimentary credit monitoring and identity protection.
Job application portals are an unusually rich target for data thieves. Applicants routinely hand over full names, home addresses, phone numbers, employment histories, and in some jurisdictions government identifiers. That information is useful both for identity fraud and for building convincing social engineering pretexts against hospital staff.
A repeat target
This is not the first publicly known security incident to have hit the hospital in recent years.
In December 2022, SickKids was hit by a ransomware attack that disrupted internal systems, hospital phone lines, and its website, and caused delays in lab and imaging results.
The LockBit ransomware gang subsequently issued a rare public apology, saying the affiliate responsible had broken its rules against encrypting medical institutions, and handed over a free decryptor, though only after the hospital had spent nearly two weeks restoring systems on its own.
In September 2023, SickKids was among the Ontario healthcare providers caught up in a breach at a third-party organization it shares perinatal and child health data with. That incident, which stemmed from mass exploitation of the MOVEit Transfer zero-day (CVE-2023-34362), exposed information on 3.4 million people, including names, home addresses, dates of birth, and health card numbers.
Healthcare remains one of the most heavily targeted sectors for both ransomware crews and data extortion groups.
Pediatric hospitals in particular sit on decades’ worth of sensitive records, which continues to make them attractive to attackers regardless of the ethical lines criminal operations claim to observe.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
