SickKids hospital ransomware attack

On 18 December 2022, The Hospital for Sick Children (SickKids) in Toronto — one of the largest and most respected pediatric hospitals in the world — was struck by a ransomware attack during the holiday period, disrupting clinical and corporate systems at a children's hospital and triggering an unusual sequence of events involving the LockBit ransomware cartel.

What happened

The attack impacted internal and corporate systems, hospital phone lines, and the SickKids website. The hospital activated a Code Grey — its designation for a system failure — and warned that the incident was causing delays in retrieving lab and imaging results and contributing to longer patient wait times. Critically, the attack encrypted only a limited number of systems, and SickKids emphasized that no patient transfers or operational shutdowns were required.

SickKids worked through the holidays to restore service, reporting roughly 50% of priority systems back online by 29 December and a near-complete recovery by mid-January 2023. The hospital stated it found no evidence that personal information of patients or staff had been compromised.

A rare apology from LockBit

The most notable feature of the incident was the response of the attacker. On 31 December 2022, the LockBit ransomware-as-a-service group posted a public statement apologizing for the attack and offering SickKids a free decryptor. LockBit claimed that one of its affiliates had violated the gang's stated rules prohibiting attacks on healthcare and other "critical" institutions, and that the offending partner had been blocked and expelled from its affiliate program.

SickKids acknowledged the apology and said it was analyzing the decryptor while continuing its own remediation. Security experts cautioned that such tools typically recover only about two-thirds of encrypted files and questioned whether LockBit's gesture was genuine remorse or a reputation-management and recruitment tactic — the group notoriously declined to extend the same courtesy to other victims.

Impact

• Clinical delays in lab and imaging results and longer patient wait times over a multi-week period.
• Disruption to phone systems and the public website.
• No confirmed theft of patient or employee data.
• A near-complete recovery within roughly four weeks.

Why it matters

The SickKids attack crystallized the debate over ransomware affiliates targeting hospitals and the hollowness of cybercriminal "ethics." It demonstrated both the real-world clinical risk of attacks on pediatric care and the chaotic accountability inside ransomware-as-a-service operations, where a central brand like LockBit could publicly disclaim an affiliate's actions yet bear ultimate responsibility for arming them. The episode became a frequently cited example in healthcare cybersecurity and in the international law-enforcement campaign that would dismantle LockBit's infrastructure in 2024.