SickKids blames a third-party app for its breach, then declines to name it

The Hospital for Sick Children in Toronto has told current and former staff and job applicants that their personal information may have been exposed in a cybersecurity incident, and attributes it to a vulnerability in a third-party software application that it says is used by SickKids and other organizations ^[1][2]. It has not named the vendor, the application, or the CVE ^[9], which means the other organizations it gestures at have been handed a warning with nothing in it they can act on.

BleepingComputer reads that framing as suggesting a wider campaign against users of the same product ^[17]. If that is right, the disclosure is worse than incomplete, it is inverted: the hospital has published the part that helps nobody and withheld the part that would let a peer institution check a version number and close a hole. If it is not right, the phrase "and other organizations" is doing reputational work rather than informational work.

What SickKids has confirmed is narrow. The external Careers website was temporarily affected and has since been safely restored ^[3]. Clinical systems and patient information were not affected, and patient care continued as usual, according to the hospital ^[4]. It opened an investigation with outside cybersecurity experts ^[8], and the findings so far indicate that personal information belonging to current and former SickKids, Boomerang and SickKids Foundation employees, as well as SickKids job applicants, may have been exposed ^[5].

What it has not said is most of the rest: which categories of data were involved, how many people are affected, or when the intrusion happened ^[10]. The review of impacted information is ongoing, and people confirmed as affected will be notified directly ^[6]. In the meantime the hospital says it has alerted everyone potentially caught up in the incident out of an abundance of caution, and is offering 24 months of credit monitoring and identity protection ^[7].

Recruiting portals are worth this attention because of what applicants volunteer: full names, home addresses, phone numbers, employment histories, and in some jurisdictions government identifiers, all useful for identity fraud and for building credible pretexts against hospital staff ^[14]. A stolen applicant list is a phishing target list with the employer relationship pre-established.

The pattern here is the more useful signal. In December 2022 SickKids was hit by ransomware that disrupted internal systems, phone lines and its website and delayed lab and imaging results ^[11]; LockBit later apologised publicly, said the affiliate had broken its rules against encrypting medical institutions, and provided a free decryptor, but only after the hospital had spent nearly two weeks restoring systems itself ^[12]. In September 2023 the hospital was among Ontario healthcare providers caught in a breach at a third-party organization it shares perinatal and child health data with, via mass exploitation of the MOVEit Transfer zero-day CVE-2023-34362, exposing data on 3.4 million people including names, addresses, dates of birth and health card numbers ^[15]. Two of the three publicly known incidents in three years came through someone else's software ^[16], and healthcare remains one of the most heavily targeted sectors for ransomware crews and extortion groups ^[13].

Watch for whether the vendor identifies itself, or whether another customer discloses first and names the product SickKids would not. Watch the affected-count and data-category disclosures when the review closes, and note the MOVEit precedent: in that case the CVE was public and customers could act ^[15]. Here they cannot.