10.9 million email addresses stolen from Abbott's cancer diagnostics unit
ShinyHunters hacker group infiltrated healthcare giant's systems to leak patient data
1Massive data breach
10.9 million unique email addresses were stolen from Abbott's cancer diagnostics unit Exact Sciences. The leaked data includes names, physical addresses, phone numbers, birth dates, and personal health information. Hacker group ShinyHunters published the data after ransom demands were allegedly refused. Abbott had detected the breach in July but only recently disclosed the full scope of the compromised data.
2Patients and healthcare providers affected
The breach impacted patients, customers, and healthcare providers. Stolen data reportedly includes over 22 million rows of confidential doctor-patient conversations and more than 20 million medical order records. Sensitive information such as prescription types, order dates, and patient IDs were compromised. Abbott stated it would notify affected individuals as required by law.
3Started with vishing attack
The intrusion began with a voice phishing (vishing) attack. Abbott employees were tricked into sharing system access credentials with hackers. The company emphasized this was not a ransomware encryption event. The attack only affected a limited number of internal systems within the cancer diagnostics business, with no disruption to manufacturing or patient services.
4ShinyHunters' claims
The hacker group claims Abbott refused to pay ransom and failed to reach an agreement. On their dark web leak site, they allege stealing over 30 million rows of customer information, including more than 1 million Social Security numbers and 7.5 million birth dates. These claims haven't been independently verified. The group is known for leaking data when ransom demands aren't met.
5Alleged data from other companies
ShinyHunters also claims to have siphoned 425 million rows of data from Databricks, 130,000 files from SharePoint, and 89,000 contracts from Coupa. These claims remain unverified. Abbott hasn't disclosed how the data was exfiltrated or how long attackers had system access. The company stated its investigation is ongoing and more details will emerge as it progresses.
6Exact Sciences acquisition
Abbott acquired cancer diagnostics company Exact Sciences earlier this year. The breach occurred post-acquisition. In an August 5 update, Abbott acknowledged some accessed files contained personal information but stated analysis continues to determine the full scope. The company maintains only limited internal systems within its cancer diagnostics business were compromised.
7Other healthcare breaches
The healthcare sector faces increasing cyber attacks. In 2022, over 700 data breaches were reported by US healthcare organizations, affecting more than 52 million individuals. ShinyHunters has previously stolen data from Microsoft, Tokopedia, and Wishbone. The group typically leaks data when companies refuse ransom payments, creating significant reputational and financial risks.
8Patient safety risks
Such breaches increase risks of phishing scams targeting affected individuals. Stolen health data commands high prices on dark web markets. Cybersecurity experts recommend affected individuals monitor accounts and change passwords. Abbott's timely communication about breach scope and proper notification to affected parties remains crucial for maintaining patient trust and mitigating potential harm.