SickKids data breach exposes employee and job applicant personal info

A cybersecurity incident at The Hospital for Sick Children (SickKids) in Toronto exposed the personal information of current and former employees, as well as job applicants. The breach is attributed to a vulnerability in third-party software used by SickKids and other organizations, although the vendor, application, or CVE involved has not been named. Approximately 3.4 million people were affected in a previous incident in September 2023 stemming from mass exploitation of the MOVEit Transfer zero-day (CVE-2023-34362), which exposed information on individuals including names, home addresses, dates of birth, and health card numbers. The current breach resulted in unauthorized access to employee data, with clinical systems and patient records remaining untouched; however, the hospital's public-facing Careers website was temporarily pulled offline before being restored.