Medtronic: Medtronic confirms breach after hackers claim 9 million records theft

Medtronic Confirms Cyberattack by ShinyHunters, 9 Million Records Allegedly Stolen

Medical device manufacturer Medtronic disclosed a cybersecurity breach last week, revealing that hackers accessed data within its corporate IT systems. The attack was claimed by the notorious extortion group ShinyHunters, which alleged the theft of over 9 million records containing personally identifiable information (PII) and terabytes of internal corporate data.

Medtronic, the world’s largest medical device company by revenue ($33.5 billion) with operations in 150 countries, stated that the breach did not affect customer data, patient safety, or its manufacturing and distribution networks. The company emphasized that its product systems, hospital customer networks, and financial reporting infrastructure remained secure and separate from the compromised IT environment.

ShinyHunters listed Medtronic as a victim on April 18, threatening to leak the stolen data unless the company engaged in ransom negotiations by April 21. The group’s listing has since been removed from its leak site, though the reason remains unclear. Medtronic is conducting an investigation to determine whether any personal data was exposed and has pledged to notify affected individuals if necessary.

While the full scope of the breach is still under review, the incident highlights the persistent threat of data extortion attacks targeting major healthcare and technology firms.

Source: https://www.bleepingcomputer.com/news/security/medtronic-confirms-breach-after-hackers-claim-9-million-records-theft/

Medtronic cybersecurity rating report: https://www.rankiteo.com/company/medtronic

"id": "MED1777300385",
"linkid": "medtronic",
"type": "Cyber Attack",
"date": "4/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Healthcare, Medical Devices',
                        'location': 'Global (Headquartered in the U.S.)',
                        'name': 'Medtronic',
                        'size': 'Large (Revenue: $33.5 billion)',
                        'type': 'Medical Device Manufacturer'}],
 'customer_advisories': 'Pledged to notify affected individuals if necessary',
 'data_breach': {'data_exfiltration': 'Yes',
                 'number_of_records_exposed': 'Over 9 million',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)',
                                              'Internal corporate data']},
 'description': 'Medical device manufacturer Medtronic disclosed a '
                'cybersecurity breach where hackers accessed data within its '
                'corporate IT systems. The attack was claimed by the extortion '
                'group ShinyHunters, which alleged the theft of over 9 million '
                'records containing personally identifiable information (PII) '
                'and terabytes of internal corporate data.',
 'impact': {'data_compromised': 'Over 9 million records containing PII and '
                                'terabytes of internal corporate data',
            'identity_theft_risk': 'High',
            'systems_affected': 'Corporate IT systems'},
 'investigation_status': 'Ongoing',
 'motivation': 'Extortion',
 'ransomware': {'data_exfiltration': 'Yes'},
 'references': [{'source': 'Cyber Incident Description'}],
 'response': {'communication_strategy': 'Public disclosure, investigation '
                                        'ongoing'},
 'threat_actor': 'ShinyHunters',
 'title': 'Medtronic Cyberattack by ShinyHunters',
 'type': 'Data Breach, Extortion'}