TECH Signal 425
SickKids restores careers site after intruder exposed staff and applicant data via third-party flaw
↗
Toronto's Hospital for Sick Children restored its external careers website after an intruder exploited a vulnerability in a third-party application, exposing data of current and former staff and job applicants, though clinical systems were unaffected.
The breach shows that third-party software vulnerabilities can compromise even well-defended organizations, and that the impact may extend beyond the primary target. For engineers, it underscores the need to assess the security of third-party components and to have incident response plans that include notifying affected individuals promptly. The hospital's offer of credit monitoring indicates the sensitivity of the data involved.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
SickKids' external careers site was taken down after an intruder exploited a vulnerability in a third-party software application.
Data of current and former staff, job applicants, and those at the SickKids Foundation and Boomerang clinic may have been exposed.
Clinical systems and patient information were not affected, and the hospital says it wasn't the only organization impacted by the vulnerability.
THE CLUSTER