Toronto’s Hospital for Sick Children, commonly referred to as SickKids, says the data of current and former staff, as well as job applicants, was exposed after an intruder exploited a security flaw in a third-party software application used by the hospital. SickKids, which may ring a bell for those who have kept close tabs on ransomware news in recent years, said the intrusion affected its external careers site, which has now been restored. “Clinical systems and patient information were not affected, and patient care has continued as usual,” it said, after explaining that the break-in was a result of a vulnerability in a “third-party software application used by SickKids and other organizations." Current and former employees of SickKids, the SickKids Foundation, and the hospital’s Vaughan, Ontario-based Boomerang clinic may all be affected, as were SickKids job applicants. The hospital did not comment on the scale of the breach, but said those affected will be offered the usual identity and credit monitoring services. “Our review of the impacted information is ongoing. Individuals determined to have been impacted will be notified directly, though, out of an abundance of caution, all potentially impacted individuals have been alerted and offered 24 months of complimentary credit monitoring and identity protection services. “Safeguarding the privacy and security of personal information is a responsibility SickKids takes seriously. We remain committed to maintaining strong protections and continuously enhancing our cybersecurity measures to help protect the information entrusted to us.” SickKids’ lucky ransomware escape The children’s hospital is no stranger to cyber struggles. On December 18, 2022, it was targeted by a LockBit ransomware affiliate – a particularly egregious attack even for LockBit and one that attracted an overwhelmingly negative reaction. The ransomware operator issued an ultra-rare apology on December 31, 2022, announcing that it would offer SickKids a free decryptor and that the affiliate who carried it out was expelled from the program. Banished from the darkest corner of cybercrime… now that’s a feat. By that time, however, SickKids had been handling the recovery well, and had restored around 60 percent of its systems after refusing to pay the crooks a ransom. LockBit’s gesture of goodwill later turned out to be an anomaly, however, as exactly a year later it refused to roll back the attack on Saint Anthony Hospital, a children’s healthcare facility in Chicago. ®
/s3/static.nrc.nl/wp-content/uploads/2026/08/13122634/210826ECO_2035252131_Cargill.jpg)
/s3/static.nrc.nl/wp-content/uploads/2026/08/21162108/210826VER_2036117161_pro.jpg)
