The Hospital for Sick Children (SickKids) says the personal information of some current and former employees was accessed without authorization in a cybersecurity incident, though patient records and clinical systems were not affected.
In a statement posted to its website, the Toronto children's hospital said the incident temporarily disrupted its external Careers website, which has since been restored. The hospital linked the breach to a vulnerability in a third-party software application that is also used by other organizations.
According to a SickKids statement, patient care has continued as usual and no patient information was involved.
The hospital launched an investigation after learning of the incident and brought in external cybersecurity experts to support its response. Through that investigation, SickKids determined that personal information belonging to some current and former employees of SickKids, Boomerang and SickKids Foundation, as well as some SickKids job applicants, may have been affected.
The hospital said its review of the affected information is ongoing. Individuals who are determined to have been impacted will be notified directly.
In the meantime, out of what the hospital described as an abundance of caution, all potentially impacted individuals have already been alerted and offered 24 months of complimentary credit monitoring and identity protection services.
SickKids said it takes the privacy and security of personal information seriously and remains committed to strengthening its cybersecurity measures to protect the information entrusted to the institution.
The hospital did not specify how many people may have been affected, what types of personal information were involved, or when the incident was first detected. The vulnerability in the third-party software has not been named publicly.
The hospital also noted unrelated construction activity on its site, advising that watermain and road restoration work may affect travel to SickKids through spring 2027, and encouraging visitors to allow extra time and plan their routes in advance.
SickKids, located in downtown Toronto, is one of Canada's largest pediatric hospitals and a major research institution, serving patients from across the Greater Toronto Area and Ontario.
Anyone who has worked at, applied to, or been affiliated with SickKids, Boomerang or SickKids Foundation and has questions about the incident is encouraged to watch for direct notification from the hospital and to consider the credit monitoring services being offered.
This story will be updated if SickKids releases further details about the scope of the incident.
