Toronto's Hospital for Sick Children, known as SickKids, says it recently experienced a cybersecurity breach that resulted in unauthorized access to data belonging to current and former employees. The hospital disclosed the incident as it began working through who was affected and how.
In sharing the news, SickKids sought to reassure families by stressing what was not touched. The hospital says patient information and its clinical systems were not affected by the breach, and that it has continued to deliver patient care as usual throughout.
According to the hospital, the breach is linked to a vulnerability in third-party software. Notably, that software is not unique to SickKids, as the hospital says it is used by other organizations as well, pointing to a weakness that reached beyond a single institution.
The scope of the incident extends past the hospital's own staff. SickKids says the breach may have also affected the personal information of some workers at its charity, as well as workers at its pediatric clinic, Boomerang Health.
Beyond current and former staff and those affiliated organizations, the hospital says the incident may also have involved the personal information of job applicants, widening the group of people who could have had their details exposed.
SickKids says it is taking steps to inform those involved rather than leaving them to find out on their own. The hospital says all impacted individuals will be notified directly about the breach and what it means for them.
To help limit any potential fallout, the hospital is also offering support to anyone who may have been caught up in the incident. SickKids says it is providing two years of complimentary credit monitoring and identity protection services to those who were potentially impacted.