ShinyHunters Leaks 7.1 Million Baxter International Records in Extortion Attack
The notorious data theft and extortion group ShinyHunters has claimed responsibility for a cyberattack on Baxter International, a leading medical device manufacturer based in Deerfield, Illinois. The breach, detected on August 13, 2026, involved unauthorized access to certain third-party applications, prompting Baxter to launch an investigation with cybersecurity and digital forensics experts. While the company confirmed the incident, it stated that patient services, business operations, and product functionality remained unaffected, with no anticipated material financial impact.
On August 14, 2026, ShinyHunters added Baxter to its dark web leak site, setting an August 17 deadline for payment negotiations. When Baxter either refused or failed to meet demands, the group released 7.1 million allegedly stolen records on August 19. ShinyHunters claims the data includes Salesforce records containing personally identifiable information (PII), though Baxter has not confirmed the specifics. The company noted that the 7.1 million records do not necessarily equate to 7.1 million affected patients and pledged to provide updates as more details emerge.
ShinyHunters has a history of targeting healthcare organizations, with recent high-profile attacks including:
- OneMedical (June 2026): 8.8TB of data, including PII of 153,000 patients.
- DentaQuest (June 2026): 234GB of data, affecting 2.6 million individuals.
- Medtronic (July 2026): PII of 3.8 million patients stolen.
Other victims include iRhythm, AdaptHealth, and Him & Hers, prompting Health-ISAC to issue a sector-wide alert in July about the group’s escalating threats.
While ShinyHunters’ attacks appear opportunistic, its focus on healthcare underscores the sector’s growing vulnerability to extortion-driven breaches. Baxter’s ongoing investigation will determine the full scope of the exposed data.
Source: https://www.hipaajournal.com/shinyhunters-baxter-international-data-breach/
hims & hers cybersecurity rating report: https://www.rankiteo.com/company/hims-&-hers
Baxter International Inc. cybersecurity rating report: https://www.rankiteo.com/company/baxter-healthcare
"id": "HIMBAX1787764358",
"linkid": "hims-&-hers, baxter-healthcare",
"type": "Breach",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Medical Devices, Healthcare',
'location': 'Deerfield, Illinois, USA',
'name': 'Baxter International',
'type': 'Corporation'}],
'attack_vector': 'Unauthorized access to third-party applications',
'customer_advisories': 'Updates to be provided as more details emerge',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '7.1 million',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (PII)',
'type_of_data_compromised': 'Personally Identifiable '
'Information (PII), Salesforce '
'records'},
'date_detected': '2026-08-13',
'date_publicly_disclosed': '2026-08-14',
'description': 'The notorious data theft and extortion group ShinyHunters has '
'claimed responsibility for a cyberattack on Baxter '
'International, a leading medical device manufacturer. The '
'breach involved unauthorized access to certain third-party '
'applications, leading to the leak of 7.1 million records '
'containing personally identifiable information (PII).',
'impact': {'data_compromised': '7.1 million records',
'identity_theft_risk': 'High (due to PII exposure)',
'operational_impact': 'No impact on patient services, business '
'operations, or product functionality',
'revenue_loss': 'No anticipated material financial impact',
'systems_affected': 'Third-party applications'},
'initial_access_broker': {'entry_point': 'Third-party applications'},
'investigation_status': 'Ongoing',
'motivation': 'Extortion, Data Theft',
'ransomware': {'data_exfiltration': 'Yes'},
'references': [{'date_accessed': '2026-08-19',
'source': 'ShinyHunters dark web leak site'}],
'response': {'communication_strategy': 'Public disclosure and updates',
'incident_response_plan_activated': 'Yes',
'third_party_assistance': 'Cybersecurity and digital forensics '
'experts'},
'threat_actor': 'ShinyHunters',
'title': 'ShinyHunters Leaks 7.1 Million Baxter International Records in '
'Extortion Attack',
'type': 'Data Breach, Extortion'}