The Hospital for Sick Children in Toronto has confirmed that personal information belonging to some current and former employees was accessed following a cybersecurity incident linked to a vulnerability in third-party software.
The Hospital for Sick Children (SickKids) in Toronto has confirmed that personal information belonging to some current and former employees was accessed during a cybersecurity incident.
The incident temporarily affected the hospital’s external Careers website, which has since been restored. SickKids said the incident was linked to a vulnerability in a third-party software application used by the hospital and other organisations.
Clinical systems and patient information were not affected by the incident and patient care continued as normal, according to the hospital.
SickKids launched an investigation after discovering the incident and brought in external cybersecurity specialists to support its response.
The investigation has determined that personal information relating to some current and former SickKids employees may have been affected. Information relating to some current and former employees of Boomerang and SickKids Foundation, as well as SickKids job applicants, may also have been involved.
The hospital has not disclosed the number of people potentially affected or provided details of the specific categories of personal information involved.
Its review of the affected information remains ongoing and SickKids said individuals confirmed as having been impacted will be notified directly.
As a precaution, the hospital has already contacted all potentially affected individuals and offered them 24 months of complimentary credit monitoring and identity protection services.
The incident highlights the potential cybersecurity risks healthcare organisations face through third-party software, even when their core clinical infrastructure is not directly affected.
SickKids said: “Safeguarding the privacy and security of personal information is a responsibility SickKids takes seriously. We remain committed to maintaining strong protections and continuously enhancing our cybersecurity measures to help protect the information entrusted to us.”
