Brand Manager

Abbott data breach: ShinyHunters claims theft of 30 million patient records. Healthcare giant Abbott Laboratories is investigating two separate cyber incidents this week, after the notorious extortion gang ShinyHunters claimed to have stolen tens of millions of records from the company's Cancer Diagnostics business. This Abbott cyber attack, now widely tracked as the ShinyHunters Abbott incident, has drawn significant attention due to the scale of records the group claims to have taken. A second, unrelated group is also claiming a separate breach of Abbott's LabCentral customer portal. Abbott has confirmed unauthorized access occurred, but disputes the scale of what attackers claim to have taken, and says the incidents have not disrupted patient care, manufacturing, or business operations. Table of Contents What ShinyHunters claims to have stolen. ShinyHunters told security outlet BleepingComputer that it broke into Abbott's systems through a vishing (voice phishing) attack targeting several employees in mid-June. The group claims this let it compromise a corporate Microsoft Entra single sign-on (SSO) account, which in turn gave it access to data across connected platforms including Salesforce, Microsoft 365, Google Workspace, SAP, ServiceNow, SharePoint, Databricks, and Coupa. According to the group's claims, the haul includes more than 30 million rows of customer personal data - names, emails, phone numbers, physical addresses, dates of birth, and over 1 million Social Security numbers. ShinyHunters further claims to have taken more than 22 million client notes containing doctor-patient conversations, over 20 million medical orders, plus internal contracts and NDAs. It's important to stress that none of this stolen data has actually been published, and researchers have not independently verified the scale of what the group claims. ShinyHunters added Abbott to its dark web extortion site, initially threatening to leak the data after July 18, before extending the deadline to July 21. Abbott's official response on the Exact Sciences breach. In an official statement, Abbott confirmed unauthorized access to a limited number of internal systems within its Cancer Diagnostics business specifically. This Abbott Exact Sciences breach involves legacy infrastructure inherited through the company's March 2026 acquisition of Exact Sciences, maker of the Cologuard and Cancerguard screening tests. Abbott says this legacy environment is separate from its core systems, and that the incident has not impacted product availability, manufacturing, lab operations, or patient care. Abbott says it activated its incident response plan, engaged outside cybersecurity experts, and notified law enforcement. The company also stated it does not currently expect the incident to have a material impact on its financial results. A second, separate claim: the LabCentral portal. A different threat actor, using the name ShadowByt3$, separately claims to have breached Abbott's Core Laboratory diagnostics business through its LabCentral customer portal, allegedly using compromised customer credentials to exploit what it described as a weak point in the environment starting July 4, 2026. This group claims to have taken manufacturing certificates, operating manuals, technical specifications, and regulatory documentation - but says no customer data was involved. Abbott disputes the significance of this claim entirely, stating that LabCentral is an externally hosted portal containing only publicly available reference documents, not sensitive business or customer information. Why ShinyHunters keeps targeting healthcare companies. This is far from ShinyHunters' first attack on the medtech sector. The group has run a sustained campaign since last year specifically targeting employees' Microsoft Entra, Okta, and Google SSO accounts through social engineering, and has previously been linked to breaches at Medtronic, OneMedical, AdaptHealth, iRhythm, and device maker Stryker - the latter targeted just after it recovered from a separate destructive attack. Healthcare and medtech companies remain attractive targets because a single compromised employee SSO login can act as a master key to dozens of connected SaaS platforms holding sensitive patient and business data - often without triggering the kind of alarms a direct network intrusion would. How to protect against vishing-based SSO attacks. Since this attack chain relies on tricking employees over the phone rather than exploiting software bugs, defenses need to focus on identity and process: * Enforce phishing-resistant MFA on SSO: FIDO2 hardware keys or platform authenticators can't be relayed over a phone call the way an SMS or voice-read OTP code can. * Verify help-desk reset requests out-of-band: Many vishing attacks target IT help desks directly, impersonating employees to request password or MFA resets - require a secondary verification channel before any reset. * Monitor SaaS app access patterns: A compromised SSO account often shows unusual login locations or bulk data exports across connected apps like Salesforce or SharePoint - anomaly detection here can catch attacks in progress. * Segment legacy acquired systems: As seen here, systems inherited through acquisitions (like Exact Sciences) are common weak points - audit and isolate them promptly rather than leaving them loosely connected to core infrastructure. Frequently asked questions. Was I affected by the Abbott data breach? If you've had contact with Abbott's Cancer Diagnostics or Exact Sciences business - as a patient, customer, or through doctor-patient notes - your data may be among what ShinyHunters claims to have stolen, though this remains unverified and unpublished at this time. Who is ShinyHunters? ShinyHunters is an extortion gang that has run a sustained campaign since 2025 targeting corporate SSO accounts (Microsoft Entra, Okta, Google) through social engineering, previously linked to breaches at Medtronic, iRhythm, Stryker, and 7-Eleven. Has Abbott confirmed the full scope of the breach? Abbott has confirmed unauthorized access to a limited number of internal Cancer Diagnostics systems but has not confirmed the scale of data ShinyHunters claims to have stolen, which remains unverified by independent researchers. Is Abbott's LabCentral portal breach serious? Abbott disputes this separately claimed incident's significance, stating the LabCentral portal only contains publicly available technical documents, not sensitive customer or business data. Reported by CyberUpdates365 desk. Delivering the latest insights on enterprise security, federal AI directives, and the future of IT infrastructure. Follow Cyber Updates 365 for daily updates on how technology is reshaping the corporate landscape. * Uday Patil Cybersecurity Expert | DevOps Engineer Founder and lead author at CyberUpdates365. Specializing in DevSecOps, cloud security, and threat intelligence. My mission is to make cybersecurity knowledge accessible through practical, easy-to-implement guidance. Strong believer in continuous learning and community-driven security awareness.

Abbott Laboratories probes two cyber incidents amid extortion claims. Abbott Laboratories is investigating two separate cybersecurity incidents after confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, while also investigating a separate claim that attackers breached its LabCentral portal and stole company data. The company confirmed the Cancer Diagnostics incident after the ShinyHunters extortion gang added Abbott to its data leak site, initially threatening to publish allegedly stolen data after July 18 unless the company negotiated with the group, before later extending the deadline to July 21. When BleepingComputer asked Abbott about the alleged ShinyHunters incident, Abbott directed BleepingComputer to a statement published on its website. "Abbott is investigating a cyber incident in which there was unauthorized access to a limited number of internal systems in our Cancer Diagnostics business only," the company said. "This does not impact any business operations, product or product availability, manufacturing or lab operations, or our ability to serve patients." Abbott added that the security incident has not impacted any other Abbott businesses or systems, and said the legacy Exact Sciences systems are separate from Abbott's. The company said it activated its incident response procedures after it learned of the incident, engaged cybersecurity experts, and notified law enforcement. Abbott also stated that it does not expect the incident to have a material impact on its business or financial results. ShinyHunters claimed to BleepingComputer that it gained access through a vishing attack targeting several Abbott employees in mid-June. According to the threat actor, the attack allowed it to compromise a Microsoft Entra single sign-on (SSO) account and gain access to internal systems. Since last year, the extortion group has been conducting social engineering campaigns that target employees' Microsoft Entra, Okta, and Google SSO accounts. After gaining access to a corporate SSO account, the threat actors steal data from connected SaaS applications such as Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Adobe, Atlassian, Zendesk, Dropbox, and many others. The extortion gang has been increasingly targeting medtech companies, including Medtronic, OneMedical, and AdaptHealth. BleepingComputer has learned that ShinyHunters was also behind the iRhythm data breach and targeted Stryker soon after the company recovered from a destructive Iranian data-wiping attack. When asked what data was allegedly stolen, ShinyHunters claimed it exfiltrated data from Microsoft Entra, ServiceNow, SharePoint, Databricks, and Coupa, including internal documents, contracts, and customer information. The threat actor further claimed to have stolen more than 30 million rows of customer personally identifiable information (PII) from multiple datasets containing names, email addresses, phone numbers, physical addresses, dates of birth, and more than one million Social Security numbers. The group also claimed to have stolen over 22 million client notes containing doctor-patient conversations, more than 20 million medical orders, and customer agreements and NDAs. BleepingComputer has not independently verified the threat actor's claims regarding the stolen data. The second incident involves a threat actor known as ShadowByt3$, who contacted BleepingComputer claiming to have breached Abbott's Core Laboratory diagnostics business through its LabCentral customer portal. The threat actor said it breached the unit via its LabCentral customer portal using compromised customer credentials after identifying what it described as a "weak point" in the environment. According to the threat actor, they gained access on July 4, 2026, after which they slowly exfiltrated files by targeting API endpoints. ShadowByt3$ claims the stolen data includes CE manufacturing certificates, operation manuals, technical specifications, regulatory documentation, product requirement archives, calibrator value assignments, assay files, and other product documentation related to Abbott's laboratory diagnostic systems. The group says no customer data was stolen, but claims it obtained sensitive business documents and intellectual property. It also provided BleepingComputer with screenshots and a file listing as purported proof of the intrusion. Abbott confirmed to BleepingComputer that it is aware of the "potential" cyber incident but disputed the threat actor's characterization of the data it claims to have stolen, stating that all data stored in the environment is public and not sensitive. "LabCentral is an externally facing third-party hosted portal used by Abbott's core laboratory diagnostics business," an Abbott spokesperson told BleepingComputer. "It houses publicly available technical product reference documents, including operating manuals, troubleshooting checklists and product specifications, and does not contain proprietary/sensitive customer or business information." At this time, neither ShinyHunters nor ShadowByt3$ has publicly released data they claim to have stolen from Abbott.