SickKids Hospital Reports Data Breach of Employee and Job Applicant Info
The Hospital for Sick Children (SickKids) has disclosed a cybersecurity incident that has compromised the personal information of some current and former employees, as well as job applicants. The breach was attributed to a vulnerability in third-party software used by SickKids and other organizations, leading to unauthorized access to employee data. The hospital has clarified that clinical systems and patient records remained secure, and its public-facing Careers website was temporarily taken offline but has since been restored.
SickKids announced the incident this week, stating that the investigation is ongoing and is being conducted with the assistance of external cybersecurity experts. The findings suggest that personal information belonging to employees of SickKids, Boomerang (a SickKids-owned pediatric clinic), and the SickKids Foundation may have been exposed. However, the hospital has not disclosed specific details regarding the types of data involved, the number of individuals affected, or the exact timing of the breach.
In response to the incident, SickKids has proactively notified all individuals who may have been affected and is offering 24 months of complimentary credit monitoring and identity protection services. Job application portals are often targeted by data thieves due to the sensitive information they collect, including full names, addresses, phone numbers, and employment histories, which can be exploited for identity fraud and social engineering attacks.
This incident is not the first security breach to affect SickKids in recent years. In December 2022, the hospital experienced a ransomware attack that disrupted internal systems and delayed lab and imaging results. The LockBit ransomware group later issued a public apology for the attack, stating that the affiliate responsible had violated their policy against targeting medical institutions.
Additionally, in September 2023, SickKids was involved in a data breach at a third-party organization that shared perinatal and child health data, which exposed information on approximately 3.4 million individuals. The healthcare sector continues to be a prime target for ransomware and data extortion groups, with pediatric hospitals being particularly vulnerable due to the sensitive nature of their records. As attackers increasingly exploit valid credentials, the effectiveness of prevention measures diminishes significantly.
