SICKKIDS REPORTS UNAUTHORIZED ACCESS TO EMPLOYEE INFORMATION THROUGH THIRD-PARTY SOFTWARE

TORONTO, ONTARIO — August 21, 2026 — The Hospital for Sick Children has reported a cybersecurity incident involving unauthorized access to personal information belonging to some current and former SickKids employees, Boomerang employees, SickKids Foundation employees and job applicants.

The incident temporarily affected the hospital’s external Careers website, which has since been safely restored. SickKids connected the incident to a vulnerability in a third-party software application used by the hospital and other organizations.

SickKids said its clinical systems and patient information were not affected. Patient care continued without interruption during the response.

The hospital launched an investigation after discovering the incident and engaged external cybersecurity specialists to assist with determining its scope and supporting containment and recovery efforts.

The ongoing review indicates that information associated with some current and former SickKids employees may have been affected. The potentially affected population also includes employees of Boomerang and the SickKids Foundation, along with people who applied for jobs at SickKids.

SickKids has not identified the specific categories of personal information involved. The hospital has also not disclosed the number of affected individuals, the name of the third-party application, the vulnerable software component or the date unauthorized access began.

No threat actor, criminal organization or ransomware operation has been publicly connected to the incident. SickKids has not stated that its internal hospital network, clinical applications or patient-care systems were accessed through the third-party vulnerability.

The distinction between potentially affected individuals and confirmed exposure remains important because the hospital’s review of the impacted information is still underway. SickKids said people determined to have been affected will receive direct notifications.

All individuals who may have been affected have already been alerted as a precaution and offered 24 months of complimentary credit monitoring and identity-protection services.

Credit monitoring can help identify unauthorized use of financial or identity information, but it does not establish which records were accessed. The complete risk to each person will depend on the information identified during the hospital’s review.

The incident demonstrates the exposure organizations can inherit from externally supplied applications. A vulnerability in third-party software can affect systems operated by multiple organizations even when their central networks and primary clinical platforms remain protected.

The temporary disruption to the Careers website also indicates that employment and recruitment systems can contain information requiring protections comparable to other sensitive institutional records. Applicant data may include contact information, employment histories and other material submitted during the hiring process, though SickKids has not confirmed which data fields were involved in this incident.

The 2026 incident is separate from the ransomware attack SickKids experienced in December 2022.

That earlier attack began on December 18, 2022, and led the hospital to activate a Code Grey for system failure. Several internal clinical and corporate systems, telephone lines and webpages were affected, while patient care continued through established downtime procedures.

During the 2022 response, clinical teams experienced delays retrieving some laboratory and diagnostic-imaging results. The hospital’s usual prescription-transmission process and internal staff timekeeping system were also affected.

SickKids reported on December 29, 2022, that almost half of its priority systems had been restored. At that stage, the hospital was manually testing and validating systems before returning them to full operation.

The hospital said at the time that it had no evidence personal information or personal health information was affected by the 2022 attack. That event involved direct disruption to internal systems, while the current incident centers on unauthorized access to personal information through a third-party application connected to the external Careers website.

SickKids said it remains committed to strengthening its cybersecurity protections and safeguarding the information entrusted to the hospital.

The investigation and review of affected records remain active. Additional notifications may be issued as SickKids determines which individuals and information were involved.

The Hospital for Sick Children (SickKids), August 20, 2026. (Free Download)

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE