sickkids.ca Listed by lockbit3 Ransomware Group

On December 31, 2022, the Canadian pediatric hospital sickkids.ca appeared on the LockBit 3.0 ransomware leak site. The group publicly stated it had obtained internal files during a ransomware attack, then issued an unusual apology, returned a decryptor for free, and announced that the responsible affiliate had been removed from its program.

Details from the Leak Site

The LockBit 3.0 listing states that internal files were exfiltrated from the hospital’s systems. The disclosure does not specify the volume or exact types of records taken, nor does it list any patient data categories. The group’s post explicitly apologizes for the incident, states that the attacking partner violated internal rules, states the partner has been blocked, and notes that a decryptor was provided at no cost. The primary source, hosted on the LockBit leak infrastructure and archived via ransomware.live, contains no further technical details about initial access methods or exfiltration tools.

Why This Matters for You and Your Family

When a children’s hospital suffers a breach, the data involved often includes information tied to real families: names, dates of birth, medical record numbers, addresses, and sometimes guardian contact details. Even if the leak site does not quantify affected records, any exposure of hospital internal files creates long-term risk for the children and parents whose information was stored on those systems. Medical data is especially sensitive because it can be used for insurance fraud, identity theft, or targeted harassment. If your child received care at SickKids, your family’s details may now sit in an attacker’s archive, ready to surface months or years later when least expected.

The Doxxing and Identity-Chain Risks

Internal hospital files frequently contain enough personal anchors—email addresses, phone numbers, home addresses, and patient IDs—to link disparate online handles back to real identities. Once mapped, these connections allow follow-on attacks: credential stuffing against family email accounts, social engineering of children through gaming platforms, or sale of the full identity package on underground forums. Credential leaks like this one cascade into account takeovers that can compromise everything from school portals to family banking. Children’s gaming accounts are particularly vulnerable because kids often reuse simple passwords or email addresses tied to their medical records. The result is a doxxing chain that can expose your family’s physical location, daily routines, and private health history.

LockBit 3.0’s Known Track Record

Public reporting attributes LockBit’s initial emergence to 2019, with the rebranded LockBit 3.0 appearing in early 2022. The group has claimed responsibility for attacks on hundreds of organizations worldwide, including healthcare providers, school districts, and critical infrastructure. Its typical playbook involves initial access through compromised credentials or vulnerable remote desktop services, followed by rapid lateral movement, data exfiltration, and dual extortion—demanding payment both to decrypt files and to prevent publication. In this case the group deviated from its standard approach by disavowing the affiliate and supplying a free decryptor, which illustrates that even established ransomware operations sometimes prioritize reputation management over immediate profit.

What to do

• Run a DoxxScan to map every link between your family’s emails, phones, patient IDs, and online handles across 13.1B+ breach records and 100+ platforms.
• Enable continuous DoxxScan monitoring so the next exposure of your or your children’s information is caught and addressed in hours rather than months.
• Rotate any password you or your children ever used at sickkids.ca or related hospital portals, then enable 2FA through an authenticator app everywhere that password was reused.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that can be chained back to the same address or medical records.
• Let remediation specialists handle ongoing takedown requests for any exposed family information appearing on data broker or extortion sites.

The SickKids incident demonstrates that even organizations with strong public reputations can fall victim to ransomware, leaving ordinary families exposed long after the headlines fade. Start your DoxxScan trial today and put continuous monitoring, identity-chain mapping, and hands-on specialist remediation to work for your household. DoxxScan by GalaxyWarden is built precisely for these moments—protecting you and your children when a single breach begins to ripple outward.