SickKids hit by cyber breach targeting employee info

The Hospital for Sick Children is alerting the public to a “cybersecurity incident” that exposed the personal information of some current and former employees.

The “targeted” breach temporarily impacted the hospital's external careers website via “a vulnerability in a third-party software application used by SickKids and other organizations.”

The website was temporarily down but is back online.

“Clinical systems and patient information were not affected and patient care has continued as usual,” said a release posted on the hospital’s homepage.

“After learning the incident, SickKids launched an investigation and engaged external cybersecurity experts to help support our investigation and response efforts,” the release continued. “Through our investigation, we have determined that personal information of some current and former SickKids, Boomerang and SickKids Foundation employees as well as SickKids job applicants, may have been affected.”

The hospital said it is still reviewing what specific information was exposed.

“Individuals determined to have been impacted will be notified directly, though, out of an abundance of caution, all potentially impacted individuals have been alerted and offered 24 months of complimentary credit monitoring and identity protection services,” the hospital said.

“Safeguarding the privacy and security of personal information is a responsibility SickKids takes seriously,” the release concluded. “We remain committed to maintaining strong protections and continuously enhancing our cybersecurity measures to help protect the information entrusted to us.”