The Hospital for Sick Children in Toronto says a recent cybersecurity “incident” resulted in unauthorized access to the personal information of some of its current and former employees.
In an email to CTV News, SickKids confirmed the breach, which it said temporarily affected its external careers website. That website has since been restored.
A spokesperson said that the hospital’s clinical systems and patient information were not affected.
The incident is believed to be linked to a “vulnerability” in a third-party software application used by SickKids and other unnamed organizations, the hospital went on to say.
An investigation into the breach determined that, in addition to the data of some current and former SickKids staff, the personal information of workers at the SickKids Foundation and Boomerang Health (a pediatric clinic in Vaughan launched by the hospital) was also compromised.
A letter sent to some current and former SickKids employees viewed by CTV News stated that the breach was first identified on July 9 and involved a system supporting both its careers website and “certain Human Resources functions, including payroll.”
The hospital said in the letter that it believes individuals who were part of its workforce between Dec. 12, 2016 and Aug. 31, 2018, “may have had sensitive personal information on the impacted system.”
“Our review of the impacted information is ongoing,” a spokesperson said in a statement. “Individuals determined to have been impacted will be notified directly, though, out of an abundance of caution, all potentially impacted individuals have been alerted and offered 24 months of complimentary credit monitoring and identity protection services.”
The hospital was previously the victim of a ransomware attack in 2022, which delayed lab and imaging results, knocked out phone lines and shut down the staff payroll system for weeks.
