SickKids says employee and job applicant data stolen through third-party software
The Hospital for Sick Children in Toronto disclosed on Aug. 20 that hackers likely stole personal information about current and former employees and job applicants through a third-party software application.
SickKids is one of Canada's best-known pediatric hospitals, and this is the third security incident to touch it since late 2022. The hospital said no clinical systems or patient information were involved.
What happened
The incident briefly took down the hospital's external careers website, which prompted the investigation, The Record reported. The site has since been restored.
According to the hospital, the people who may be affected include current and former SickKids employees, job applicants, and staff of related organizations, including the SickKids Foundation and Boomerang Health. Affected people are being notified directly and offered 24 months of credit monitoring and identity protection.
What we don't know yet
SickKids has not named the vendor or application, said what categories of personal information were taken, or given a count of affected people. It also did not say when the intrusion began, and the review was still under way when the notice was issued. No ransomware group had publicly claimed the incident in the coverage reviewed.
Context
In December 2022, a ransomware attack forced SickKids to shut down systems just before Christmas, slowing pharmacy, diagnostic imaging and staff timekeeping functions for weeks. The LockBit group later apologized and released a free decryptor. In 2023, the hospital was also caught up in a breach linked to a third-party data-sharing organization.
Vendor-hosted HR and recruitment platforms have become a common route into employee data at large employers, because they hold detailed records but sit outside the organization's own network monitoring.
What to do
- Current and former staff and recent applicants should enrol in the offered credit monitoring when the notification arrives.
- Be wary of calls, texts or emails that reference SickKids employment or job applications and ask for personal or banking details.
- Consider placing a fraud alert with Equifax and TransUnion if your social insurance number may have been involved.
