Loading story…
The Hospital for Sick Children (SickKids) in Toronto disclosed a cybersecurity incident in which attackers gained unauthorized access through a vulnerability in an unnamed third-party software application, exposing personal information tied to current and former employees, job applicants, and staff associated with the SickKids Foundation and Boomerang. The intrusion briefly forced the hospital to take its public-facing careers website offline before restoring it, and investigators believe data was stolen during the breach.
SickKids said its clinical systems, patient records, and patient care operations were not affected. The hospital is investigating with external cybersecurity experts, has begun notifying potentially affected individuals, and is offering 24 months of credit monitoring and identity protection. The organization has not yet identified the software vendor, disclosed a CVE, or provided the full scope and timing of the compromise.
See attribution, scope, and your downstream exposure.
8 events from the most recent confirmed update back to the earliest known activity.
A letter viewed by CTV News said SickKids first identified the cybersecurity incident on July 9. The affected system supported the hospital’s careers website and certain human resources functions, including payroll.
In September 2023, SickKids was among Ontario healthcare providers affected by a third-party breach tied to mass exploitation of MOVEit Transfer vulnerability CVE-2023-34362. The breach reportedly exposed data on 3.4 million people, including names, addresses, dates of birth, and health card numbers.
In December 2022, SickKids suffered a ransomware attack that disrupted internal systems, hospital phone lines, and its website. The incident also affected operations including pharmacy systems, diagnostic imaging or lab results, and staff timekeeping.
After identifying the employee and applicant data security incident, SickKids said it notified relevant law enforcement authorities. The hospital also said clinical systems and patient data were unaffected and patient care continued without disruption.
SickKids said it alerted everyone potentially affected out of caution and will directly notify individuals confirmed as impacted. The hospital is offering 24 months of complimentary credit monitoring and identity protection services.
Following the incident, SickKids temporarily took its public-facing Careers website offline and launched an investigation with outside cybersecurity experts. The hospital later restored the site safely.
SickKids disclosed a recent cybersecurity incident involving unauthorized access and likely theft of personal information linked to a third-party software application. The potentially affected groups include current and former employees, job applicants, employees of Boomerang, and employees of the SickKids Foundation.
After the 2022 ransomware attack, the LockBit gang publicly apologized and offered SickKids a free decryptor. One report also says the group claimed it fired the affiliate responsible for targeting the hospital.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
7 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcecyberveille.ch
Open sourcescworld.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcectvnews.ca
Open sourcesickkids.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Craneware, a U.K.-based healthcare software company whose products are used by more than 2,000 U.S. hospitals and nearly 10,000 clinics and retail pharmacies, disclosed that attackers breached a subset of its internal data environment and exfiltrated employee, customer, and business partner information. The company said unauthorized individuals viewed and copied a significant volume of file names tied largely to non-sensitive or publicly available regulatory data, but confirmed that some sensitive corporate records were also taken. The company said the intrusion has been contained and that the attackers no longer have access, with no disruption reported to Craneware operations or the hospital services it supports. Craneware said it activated its incident response plan, brought in external cybersecurity and forensic investigators, and notified the FBI and the U.K. Information Commissioner’s Office, while continuing to determine the full scope of the breach and whether any additional impacted data sets are involved.
Jul 22, 2026
Multiple healthcare organizations disclosed **data security incidents** involving potential exposure of patient and personal information. Jackson Hospital and Clinic (Montgomery, Alabama) notified **14,485** individuals about a breach at its former debt-collection vendor **Nationwide Recovery Services**, where suspicious activity was identified in July 2024 and an unauthorized party accessed the vendor’s network between **July 5–15, 2024**. Jackson Hospital stated its own IT systems were not affected, but data shared for collections work may have been compromised, including **names, contact details, dates of birth, Social Security numbers, account/insurance information, and dates of service**; affected individuals were offered credit monitoring and identity theft protection. Separately, **Community Health Action of Staten Island** reported a data security incident that may have involved unauthorized access to sensitive personal and medical information, and **Insight Hospital and Medical Center** (Chicago) reported a cyber incident involving unauthorized access to its network between **Aug. 22 and Sept. 11, 2025**, with potential exposure of patient and financial data. The disclosures underscore ongoing third-party and direct-network intrusion risks in the healthcare sector, with notification timing and scope varying by organization and investigation status.
Jun 29, 2026