SickKids discloses data breach exposing employee and job applicant details

KUALA LUMPUR, 21 AUGUST 2026 —

The Hospital for Sick Children (SickKids) disclosed a cybersecurity incident that exposed personal information of current and former employees, as well as job applicants, due to a flaw in third-party software.

The hospital did not name the vendor, the application, or the CVE involved, though the framing suggests a wider campaign against users of the same product. The external Careers website was temporarily affected and has since been restored, according to the statement.

Clinical systems and patient information were not affected, and patient care continued as usual. After learning of the incident, SickKids launched an investigation with the help of outside cybersecurity experts. The findings indicate that personal information belonging to current and former SickKids, Boomerang (a SickKids-owned pediatric clinic), and SickKids Foundation employees, as well as SickKids job applicants, may have been exposed.

The hospital has not said what categories of data were involved, how many people are affected, or when the intrusion took place. Its review of the impacted information is ongoing, with individuals confirmed as affected to be notified directly. In the meantime, SickKids says it has alerted everyone potentially caught up in the incident out of caution, and is offering 24 months of complimentary credit monitoring and identity protection.

Job application portals are an unusually rich target for data thieves, as applicants routinely hand over full names, home addresses, phone numbers, employment histories, and in some jurisdictions government identifiers. That information is useful both for identity fraud and for building convincing social engineering pretexts against hospital staff.

This is not the first publicly known security incident to hit the hospital in recent years. In December 2022, SickKids was hit by a ransomware attack that disrupted internal systems, hospital phone lines, and its website, and caused delays in lab and imaging results.

The LockBit ransomware gang subsequently issued a rare public apology, saying the affiliate responsible had broken its rules against encrypting medical institutions, and handed over a free decryptor, though only after the hospital had spent nearly two weeks restoring systems on its own.

In September 2023, SickKids was among Ontario healthcare providers caught up in a breach at a third-party organization it shares perinatal and child health data with. That incident, which stemmed from mass exploitation of the MOVEit Transfer zero-day (CVE-2023-34362), exposed information on 3.4 million people, including names, home addresses, dates of birth, and health card numbers.

Healthcare remains one of the most heavily targeted sectors for both ransomware crews and data extortion groups. Pediatric hospitals in particular sit on decades' worth of sensitive records, which continues to make them attractive to attackers regardless of the ethical lines criminal operations claim to observe.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. According to a third-party cybersecurity report, signature-based prevention fell to 50%.

Related: Kuala Lumpur