SickKids children’s hospital bandages up careers website after intruder breaks in

Toronto’s Hospital for Sick Children, better known as SickKids, announced that personal data of current and former employees, along with job applicants, was exposed due to an intruder exploiting a security flaw in a third-party software application. The breach specifically impacted the hospital's external careers website, which has since been restored. The statement clarified that clinical systems and patient information remained untouched, ensuring the continuity of patient care.

SickKids mentioned that current and former employees of the hospital, the SickKids Foundation, and the Boomerang clinic in Vaughan, Ontario, as well as job applicants, may all have been affected. However, the hospital refrained from detailing the extent of the breach. Affected individuals will be offered identity and credit monitoring services as standard practice.

The hospital disclosed that all potentially affected individuals were already notified, with an offer of 24 months of complimentary credit monitoring and identity protection services for precautionary measures.

SickKids emphasized its commitment to safeguarding personal information and stressed the importance of maintaining robust cybersecurity measures. The hospital highlighted its dedication to protecting the information entrusted to it. In a notable incident earlier this year, SickKids faced a LockBit ransomware attack on December 18, 2022.

The attack, one of the most severe on record for LockBit, did not go unnoticed. In a rare move, the ransomware affiliate responsible for the assault issued an apology and offered SickKids a free decryptor. Despite this goodwill gesture, the affiliate was subsequently expelled from the LockBit program. While SickKids efficiently managed the recovery process and restored approximately 60 percent of its systems without paying the ransom, LockBit later reneged on its promise to reverse the attack on Saint Anthony Hospital, a children's healthcare facility in Chicago, just a year later.