Medtronic: Medtronic notifies impacted patients of data breach tied to April hack

Medtronic Data Breach Exposes Patient Information in April 2026 Cyberattack

Medtronic, a leading medical technology company, disclosed a data breach affecting an undisclosed number of patients after an unauthorized party accessed corporate IT systems between April 13 and April 19, 2026. While the breach has not yet appeared on the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) portal, state-level disclosures reveal significant impacts: 297,000 individuals in Texas, 63,500 in Massachusetts, and 8,700 in Vermont were affected.

The exposed data may include names, Social Security numbers, contact details, birthdates, and health-related information, though Medtronic stated there is no evidence the compromised data has been publicly leaked or posted online. The company also confirmed that patient safety, device functionality, and manufacturing operations remained unaffected by the incident.

Medtronic is offering 24 months of complimentary credit monitoring, identity theft restoration, and dark web monitoring to impacted individuals. The breach was first publicized by the ShinyHunters threat group, which claimed to have stolen 9 million records and posted the hack on its leak site before removing the listing. Medtronic has not verified these claims.

ShinyHunters, known for recent high-profile attacks including a ransom demand against Amazon’s One Medical Senior Health has been linked to multiple extortion attempts targeting healthcare and corporate entities. The group’s involvement in the Medtronic breach underscores ongoing cybersecurity risks in the medtech sector.

Source: https://www.techtarget.com/healthtechsecurity/news/366645324/Medtronic-notifies-impacted-patients-of-data-breach-tied-to-April-hack

Medtronic cybersecurity rating report: https://www.rankiteo.com/company/medtronic

"id": "MED1782930445",
"linkid": "medtronic",
"type": "Breach",
"date": "4/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '369,200 (297,000 in Texas, '
                                              '63,500 in Massachusetts, 8,700 '
                                              'in Vermont)',
                        'industry': 'Healthcare/MedTech',
                        'name': 'Medtronic',
                        'type': 'Medical Technology Company'}],
 'customer_advisories': 'Offering 24 months of complimentary credit '
                        'monitoring, identity theft restoration, and dark web '
                        'monitoring to impacted individuals',
 'data_breach': {'data_exfiltration': 'Claimed by ShinyHunters, not verified '
                                      'by Medtronic',
                 'number_of_records_exposed': '9 million (claimed by '
                                              'ShinyHunters, unverified by '
                                              'Medtronic)',
                 'personally_identifiable_information': 'Names, Social '
                                                        'Security numbers, '
                                                        'contact details, '
                                                        'birthdates',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Personally Identifiable '
                                             'Information (PII), Health '
                                             'Information'},
 'date_detected': '2026-04-13',
 'description': 'Medtronic, a leading medical technology company, disclosed a '
                'data breach affecting an undisclosed number of patients after '
                'an unauthorized party accessed corporate IT systems between '
                'April 13 and April 19, 2026. The exposed data may include '
                'names, Social Security numbers, contact details, birthdates, '
                'and health-related information. The breach was first '
                'publicized by the ShinyHunters threat group, which claimed to '
                'have stolen 9 million records.',
 'impact': {'data_compromised': 'Names, Social Security numbers, contact '
                                'details, birthdates, health-related '
                                'information',
            'identity_theft_risk': 'High',
            'operational_impact': 'None (patient safety, device functionality, '
                                  'and manufacturing operations unaffected)',
            'systems_affected': 'Corporate IT systems'},
 'investigation_status': 'Ongoing',
 'motivation': 'Extortion',
 'ransomware': {'data_exfiltration': 'Claimed by ShinyHunters'},
 'references': [{'source': 'ShinyHunters leak site'}],
 'regulatory_compliance': {'regulatory_notifications': 'State-level '
                                                       'disclosures (Texas, '
                                                       'Massachusetts, '
                                                       'Vermont)'},
 'response': {'communication_strategy': 'Offering 24 months of complimentary '
                                        'credit monitoring, identity theft '
                                        'restoration, and dark web monitoring '
                                        'to impacted individuals'},
 'threat_actor': 'ShinyHunters',
 'title': 'Medtronic Data Breach Exposes Patient Information in April 2026 '
          'Cyberattack',
 'type': 'Data Breach'}