Scarlett Group claims breach of Toronto's Sunnybrook Hospital
Scarlett Group claims to have breached Sunnybrook Health Sciences Centre, one of Toronto's largest hospitals, with access to complete patient records, SINs, plaintext PINs, and MyChart OAuth identities. The claim, posted Oct 29, 2026, remains unverified and the hospital has not confirmed an incident. The posts cite prior listings of the hospital by 0APT in February 2026 and by Clop in 2023; patients and staff should watch for targeted phishing.
What happened
Scarlett Group claims to have breached Sunnybrook Health Sciences Centre, one of Canada's largest teaching and research hospitals, in Toronto. The claim lists complete patient records, Social Insurance Numbers, plaintext PINs, and HR employee data. The hospital has not confirmed any incident, and no details on the volume of data allegedly taken have been shared.
Why it matters
Hospitals hold highly sensitive patient, clinical, and staff records. If the claim holds, patients and staff face targeted phishing, identity fraud, and abuse of plaintext PINs and Social Insurance Numbers. Nothing is confirmed, so the real extent of damage is still unknown.
What to do
Track Sunnybrook's official channels for confirmation and treat the claim as unverified until then. If confirmed, support patient and staff notification, reset PINs, passwords, and security questions, and strengthen phishing and identity fraud defenses.
For the technical team
- Affected
- Sunnybrook Health Sciences Centre, um dos maiores hospitais de Toronto (Canadá); segundo alegação do grupo Scarlett, reg · Sunnybrook Health Sciences Centre (Toronto, Canada). Data claimed in the post: complete patient records, full patient ID sets, plaintext PINs, full SINs (Social Insurance Numbers), Oracle patient claims, MyChart OAuth identities, HR department and employee data with SINs, password backups, and security questions.
- Exploitation
- Claim by Scarlett Group posted Oct 29, 2026 (UTC); not independently verified and not confirmed by the hospital. Reported by @AlvieriD and @DailyDarkWeb. No PoC or technical details disclosed.
- Fix
- Not applicable; alleged breach with no fixable software flaw cited.
- Vector
- Not described in the sources; the group's post does not detail how access allegedly occurred or the initial entry vector.
- More details
- @DailyDarkWeb reports the hospital was previously listed by the 0APT group in February 2026; @AlvieriD also cites Clop Ransomware in 2023. Sunnybrook runs one of the country's major trauma centres, per @DailyDarkWeb. @DailyDarkWeb classifies the post as an unverified threat-actor claim, not confirmation of a breach, and advises watching for targeted phishing and impersonation attempts if the claim holds.
Timeline
Scarlett group named Sunnybrook Health Sciences Centre on Oct 29; the claim remains unverified, with no details on the volume or type of data allegedly taken.
Incident opened.
Sources 2 sources
- @AlvieriD @AlvieriD
- @DailyDarkWeb @DailyDarkWeb
