01Summary
Abbott said on 16 July 2026 that it was investigating unauthorised access to a limited number of internal systems in its Cancer Diagnostics (Exact Sciences) business. The compromise reportedly began in mid-June, when ShinyHunters voice-phished staff and took over a Microsoft Entra single sign-on account. The group claimed about 30 million rows, including more than a million SSNs and 22 million doctor-patient notes. In August it dumped data containing 10.9 million unique emails with names, addresses, phone numbers and health records. Abbott was also looking into a separate claim by another actor about a LabCentral portal. It said operations were not affected.
02Technical analysis
- Attack vector
- Voice phishing (vishing)
- Initial access
- Compromised SSO account
03Victims and impact
Countries affected
- United States
04Data exposed
Data types
- Email addresses
- Names
- Addresses
- Phone numbers
- Health records
- Social Security numbers (claimed)
05Timeline
- 2026-06-15Compromise begins (mid-June, reported).
- 2026-07-16Abbott confirms it is investigating.
- 2026-08-07ShinyHunters dumps data containing 10.9 million emails (reported).
06Legal
Civil lawsuits
- Patient lawsuit against Abbott and Exact Sciences
07Disclosure and media
Publishing organisations
- BleepingComputer
- The Register
- HIPAA Journal
- Malwarebytes
08Sources
References
- [1]BleepingComputer: https://www.bleepingcomputer.com/news/security/abbott-laboratories-probes-two-cyber-incidents-amid-extortion-claims/
- [2]The Register: https://www.theregister.com/cyber-crime/2026/08/07/shinyhunters-called-cancer-diagnostics-biz-and-tricked-staffers-into-giving-them-access-now-theyve-dumped-109m-email-addresses/5284857