[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRK-Nklb_xlrW-4hh_bR3eatafwSht0VkVqxWvcQaWtw":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":126},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"2cd3fba2-0941-49db-bdea-01958ee5f050","SickKids data breach exposes employee and job applicant info","sickkids-data-breach-exposes-employee-and-job-applicant-info-c28837","Toronto's Hospital for Sick Children (SickKids) says a cybersecurity incident exposed the personal information of some current and former employees and job applicants, stemming from a flaw in third-party software. Clinical systems and patient records were not affected. (264) [...]","The Hospital for Sick Children (SickKids) in Toronto has reported a cybersecurity incident that exposed personal information of current\u002Fformer employees and job applicants. The breach originated from a vulnerability in a third-party software, though clinical systems and patient records were unaffected. This marks the second major security incident for SickKids in recent years, following a ransomware attack in 2022.","SickKids data breach exposes employee and job applicant info via third-party software flaw.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fsickkids-data-breach-exposes-employee-and-job-applicant-info\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2023\u002F01\u002F01\u002Fsickkids.jpg","2026-08-21T10:10:42+00:00","2026-08-21T12:00:24.408531+00:00",7,[17],{"name":18,"type":19},"MOVEit Transfer","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":20,"icon":22,"name":23,"slug":24},null,"Breaches","breaches",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":41,"vendors":125},[42,71,96],{"slug":43,"name":44,"problem":45,"products":46},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":72,"name":73,"problem":74,"products":75},"patch-management","Automated patch management","Known holes get closed in days, not months.",[76,80,88],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":72,"product_name":77,"url":78,"description":79},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":97,"name":98,"problem":99,"products":100},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",[],{"slug":127,"title":128,"body":129,"framework_refs":130,"framework_notes":141},"third-party-software-vulnerability-exposes-sickkids-employee-data","Third-Party Software Vulnerability Exposes SickKids Employee Data","The SickKids breach highlights the persistent risk of relying on third-party software without rigorous vetting and continuous vulnerability monitoring. A flaw in an external vendor's software became the entry point for attackers, exposing sensitive personal information of employees and job applicants. This is especially concerning as it represents SickKids' second major incident in just a few years, suggesting that systemic improvements to third-party risk management have not been fully implemented. Healthcare organizations are high-value targets due to the sensitivity of the data they hold, making robust supply chain security and proactive vulnerability management critical — not optional.",[131,132,133,134,135,136,137,138,139,140],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 15 – Service Provider Management","NIST SP 800-161 – Supply Chain Risk Management","NIST SI-2 – Flaw Remediation","NIST SA-9 – External Information System Services","NIST AC-3 – Access Enforcement","PIPEDA – Safeguard Principle (Canada)","ISO\u002FIEC 27036 – Information Security for Supplier Relationships","ITIL – Supplier Management Practice",{}]