SickKids Hospital Discloses Cybersecurity Breach Affecting Employee and Applicant Data The Hospital for Sick Children (SickKids) in Toronto has reported a cybersecurity incident exposing personal information of current and former employees, as well as job applicants. The breach originated from a vulnerability in a third-party software application used by the hospital and other organizations, though the vendor, specific software, and associated CVE remain undisclosed. The hospital’s public-facing Careers website was temporarily taken offline but has since been restored. Clinical systems and patient records were unaffected, ensuring uninterrupted care. An investigation, supported by external cybersecurity experts, revealed that data belonging to employees of SickKids, its subsidiary Boomerang Pediatric Clinic, the SickKids Foundation, and job applicants may have been compromised. The exact categories of exposed data, the number of affected individuals, and the timeline of the intrusion have not been released. As a precaution, SickKids has notified all potentially impacted individuals and is offering 24 months of complimentary credit monitoring and identity protection. Job application portals are frequent targets for cybercriminals due to the sensitive information they collect, including names, addresses, employment histories, and government identifiers valuable for identity fraud and social engineering attacks. This incident marks the latest in a series of cybersecurity challenges for SickKids. In December 2022, the hospital suffered a ransomware attack that disrupted internal systems, phone lines, and lab services, though the LockBit gang later issued an apology and provided a decryptor. In September 2023, SickKids was also impacted by the mass exploitation of the MOVEit Transfer zero-day (CVE-2023-34362), exposing data on 3.4 million individuals. Healthcare, particularly pediatric hospitals, remains a prime target for ransomware and data extortion groups due to the vast troves of sensitive records they maintain.

The SickKids Hospital in Toronto, a leading pediatric healthcare institution in Canada, has faced severe cyberattack-induced disruptions, resulting in critical treatment delays for patients, including children requiring urgent medical interventions. The attack strained an already overburdened healthcare system, exacerbating risks to patient safety, trust, and service continuity. While the report does not specify data breaches, the operational impact included cancelled surgeries, derailed treatment plans (e.g., chemotherapy, surgeries), and systemic shutdowns, directly threatening lives. The incident aligns with a broader national crisis in Canada’s healthcare sector, where cyber threats are escalating—mirroring global trends in the UK and US. The financial and reputational fallout, though not quantified for SickKids specifically, reflects a pattern of multi-million-dollar recovery costs (e.g., Newfoundland’s $16M breach) and long-term erosion of public confidence in healthcare resilience. The attack underscores how cyber vulnerabilities in healthcare transcend data security, directly endangering human lives by crippling essential services.

Toronto’s Hospital for Sick Children suffered a cybersecurity incident that affected some of its phone lines, web pages and clinical systems. SickKids called the hospital code for “system failure”, however, said all patient care continued without disruption.