Hospital for Sick Children discloses employee data breach

The Hospital for Sick Children (SickKids) in Toronto has disclosed a cybersecurity incident that exposed the personal information of current and former employees, job applicants, and staff from the SickKids Foundation and Boomerang, a SickKids-owned pediatric clinic.

The breach originated from a vulnerability in a third-party software application used by the hospital and other organizations. While the hospital's public-facing careers website was temporarily taken offline, it has since been restored. SickKids stated that clinical systems and patient records were not affected by the incident, and patient care continued without interruption.

The hospital is currently investigating the scope of the breach with external cybersecurity experts. While the specific categories of data and the total number of affected individuals have not been disclosed, SickKids is notifying those confirmed to be impacted and is offering 24 months of complimentary credit monitoring and identity protection services.