2022 SickKids (Toronto) — LockBit ransomware; Code Grey; decryptor released after affiliate apology
Data compromised
Operational disruption to clinical/IT systems (Code Grey); public reporting emphasized system outages more than a published patient-census dump — no attested individual PHI headcount in sources reviewed
Technical writeup
Verified hospital disclosure — December 2022. Toronto’s Hospital for Sick Children (SickKids) declared a Code Grey cybersecurity incident beginning about 9:30 p.m. on December 18, 2022 after a LockBit ransomware attack disrupted internal systems and delayed clinical workflows. SickKids published ongoing recovery updates; The Record reported roughly 80% of priority systems back online in subsequent days. LockBit’s operators publicly apologized for an affiliate hitting a children’s hospital and released a decryptor — a rare public walk-back. Contemporary coverage focused on operational impact rather than a regulator-attested patient-record census; recordsAffected 0 pending any later attested PHI headcount. Cataloged August 2026 after user inquiry; no new 2025–2026 SickKids breach identified in sources reviewed.
Root cause
LockBit ransomware affiliate attack beginning Dec 18, 2022; LockBit apologized for hitting a children’s hospital and released a decryptor