cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

SickKids Reports Employee and Applicant Data Exposed in Cybersecurity Incident

· Original article ↗

Summary

SickKids says a third-party software flaw led to unauthorized access and exposure of personal information belonging to some employees and job applicants. Clinical systems and patient records were unaffected; the investigation continues.

Key points

  • SickKids says the incident involved unauthorized access linked to a vulnerability in unnamed third-party software.
  • Personal information belonging to some current and former employees, employees of related organizations, and job applicants may have been exposed.
  • The hospital has not specified the data types, number of affected people, or when the intrusion occurred.
  • SickKids says clinical systems and patient information were unaffected, and patient care continued as usual.
  • The Careers website was temporarily taken offline and has since been restored.
  • SickKids is investigating with outside cybersecurity experts, notifying potentially affected people, and offering 24 months of credit monitoring and identity protection.

Article Details

Victim Organization
The Hospital for Sick Children (SickKids)
Incident Type
Unauthorized access and exposure of employee and job-applicant personal information, attributed by SickKids to a vulnerability in unnamed third-party software.
Data Types Exposed
  • Personal information; specific categories were not disclosed.
Affected Records
Not disclosed
Affected Data Size
Not disclosed
Operational Impact
The external Careers website was temporarily taken offline and later restored. SickKids said clinical systems and patient records were unaffected and patient care continued as usual.
Ransom Or Extortion
None reported for this incident.
Claim Status
confirmed

CVE

CVE-2023-34362progress · moveit_cloud; progress · moveit_transferThat incident, which stemmed from mass exploitation of the MOVEit Transfer zero-day (CVE-2023-34362), exposed information on 3.4 million people, including names, home addresses, dates of birth, and health card numbers.

Threat Actors

LockBitThe article reports that LockBit issued an apology after a 2022 ransomware attack on SickKids, saying the responsible affiliate had violated its rules against encrypting medical institutions. The article does not attribute the current incident to LockBit.

Products

Progress MOVEit TransferThat incident, which stemmed from mass exploitation of the MOVEit Transfer zero-day (CVE-2023-34362), exposed information on 3.4 million people, including names, home addresses, dates of birth, and health card numbers.

Industries

HealthcareIn September 2023, SickKids was among the Ontario healthcare providers caught up in a breach at a third-party organization it shares perinatal and child health data with.

Related Articles