2026 SickKids — third-party software flaw; employee/applicant PII (patients not affected)
Data compromised
Personal information of some current/former SickKids, Boomerang, and SickKids Foundation employees plus job applicants — specific field list and census not published; clinical systems and patient information not affected per SickKids
Technical writeup
Verified hospital statement — August 21, 2026. Toronto’s Hospital for Sick Children (SickKids) said a cybersecurity incident resulted in unauthorized access to personal information of some current and former SickKids, Boomerang (SickKids-owned clinic), and SickKids Foundation employees, as well as SickKids job applicants. The hospital links the incident to a vulnerability in a third-party software application used by SickKids and other organizations (vendor/CVE not named). The external Careers website was temporarily affected and restored; clinical systems and patient information were not affected and care continued. Investigation with outside experts is ongoing; people confirmed impacted will be notified, and potentially impacted individuals were alerted with 24 months of credit monitoring. recordsAffected 0 pending attested census. Distinct from the December 2022 LockBit ransomware incident (sickkids-lockbit2022).
Root cause
Company-confirmed unauthorized access via vulnerability in unnamed third-party software used by SickKids and other organizations; Careers site temporarily offline