The Hospital for Sick Children (SickKids) in Toronto has confirmed that an intruder accessed its external careers website after exploiting a vulnerability in third-party software also used by other organisations. The hospital said clinical systems and patient information were untouched and patient care continued as normal, but data belonging to current and former staff, job applicants, and people connected to the SickKids Foundation and its Boomerang clinic may have been exposed.

SickKids has not disclosed how many people were affected, but says its review is ongoing and that all potentially impacted individuals have been notified as a precaution, with 24 months of free credit monitoring and identity protection offered. The hospital, which previously suffered a major LockBit ransomware attack in December 2022 that the gang later apologised for, said it remains committed to strengthening its cybersecurity defences.