Safa Marwah
Abbott Laboratories, a global leader in medical technology, is currently embroiled in investigations concerning two distinct cybersecurity incidents, with one involving confirmed unauthorized access to internal systems within its Cancer Diagnostics division and another centering on claims of a breach targeting its LabCentral customer portal, both accompanied by demands for extortion. These separate intrusions underscore the escalating and multifaceted cyber threats confronting the healthcare and medical technology sectors, highlighting vulnerabilities ranging from legacy infrastructure to sophisticated social engineering tactics.
The first incident came to light following the prominent appearance of Abbott on the data leak site operated by the notorious ShinyHunters extortion collective. This group initially issued a threat to disseminate purportedly stolen data after July 18, subsequently extending the ultimatum to July 21, unless the company engaged in negotiations. In response to inquiries regarding the alleged breach, Abbott directed stakeholders to a public statement, confirming that its investigation revealed unauthorized access to a restricted number of internal systems specifically within its Cancer Diagnostics business. The company explicitly stated that these compromised systems are legacy Exact Sciences platforms, asserting their separation from Abbott’s broader operational infrastructure.
According to Abbott’s public communication, the breach has not impacted any core business operations, product availability, manufacturing processes, laboratory functions, or its capacity to serve patients. Furthermore, the company emphasized that no other Abbott businesses or systems were affected by this particular security event. Upon discovery, Abbott activated its comprehensive incident response protocols, engaging specialized cybersecurity experts to assist in forensic analysis and remediation, and duly notifying relevant law enforcement agencies. Despite the severity of the incident, Abbott has expressed confidence that it does not anticipate a material impact on its overall business performance or financial outcomes.
ShinyHunters, however, presented a starkly different narrative regarding the scope and method of their alleged intrusion. The group claimed to have gained initial access through a vishing attack conducted in mid-June, targeting multiple Abbott employees. Vishing, a form of social engineering, leverages voice communication to trick individuals into divulging sensitive information or performing actions that compromise security. The attackers asserted that this tactic enabled them to compromise a Microsoft Entra single sign-on (SSO) account, which subsequently provided a gateway to internal systems. This method aligns with ShinyHunters’ established pattern of employing social engineering campaigns to target corporate SSO accounts across various platforms, including Microsoft Entra, Okta, and Google, as observed since the previous year.
Once access to a corporate SSO account is established, ShinyHunters typically proceeds to exfiltrate data from a wide array of connected Software-as-a-Service (SaaS) applications. Their previous targets have included critical business platforms such as Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Adobe, Atlassian, Zendesk, and Dropbox. In the context of the Abbott incident, ShinyHunters specifically claimed to have stolen data from Microsoft Entra, ServiceNow, SharePoint, Databricks, and Coupa. The purported stolen data encompasses internal documents, contracts, and sensitive customer information.
The extent of the claimed data theft by ShinyHunters is particularly concerning for a medical technology company. The group alleged the exfiltration of over 30 million rows of customer personally identifiable information (PII), which reportedly included names, email addresses, phone numbers, physical addresses, and dates of birth. Alarmingly, they also claimed to have acquired more than one million Social Security numbers. Beyond foundational PII, ShinyHunters further asserted possession of over 22 million client notes detailing doctor-patient conversations, more than 20 million medical orders, and a trove of customer agreements and non-disclosure agreements (NDAs). It is crucial to note that these specific claims regarding the volume and nature of stolen data have not been independently verified, and Abbott has not corroborated these details.
The targeting of medical technology firms by ShinyHunters is not an isolated phenomenon. The group has a documented history of focusing on this critical sector, with previous high-profile breaches affecting companies such as Medtronic, OneMedical, and AdaptHealth. Investigations have also linked ShinyHunters to the iRhythm data breach and a subsequent attempt to target Stryker shortly after that company recovered from a destructive data-wiping attack. This sustained targeting underscores the perceived value of data held by medtech companies, ranging from intellectual property and business intelligence to highly sensitive patient information, which can be leveraged for various illicit purposes, including identity theft, fraud, and corporate espionage.
Concurrent with the ShinyHunters investigation, Abbott is also addressing claims from another threat actor, identified as ShadowByt3$. This group contacted the press, alleging a breach within Abbott’s Core Laboratory diagnostics business via its LabCentral customer portal. ShadowByt3$ contended that access was achieved on July 4, 2026, through compromised customer credentials, exploiting what they described as a "weak point" within the portal’s environment. The group further stated that they systematically exfiltrated files by targeting API endpoints over a period of time.
ShadowByt3$ claimed to have stolen a range of sensitive business and intellectual property documents from the LabCentral portal. This purportedly includes CE manufacturing certificates, detailed operation manuals, technical specifications, crucial regulatory documentation, product requirement archives, calibrator value assignments, and assay files, all related to Abbott’s sophisticated laboratory diagnostic systems. While the group maintained that no customer data was compromised in this specific incident, they provided screenshots and a file listing as evidence to substantiate their claims of intrusion and data theft.
Abbott acknowledged awareness of this "potential" cyber incident involving the LabCentral portal. However, the company disputed ShadowByt3$’s characterization of the stolen data’s sensitivity. An Abbott spokesperson clarified that LabCentral is an externally facing, third-party hosted portal utilized by Abbott’s core laboratory diagnostics business. The spokesperson asserted that the portal primarily houses publicly available technical product reference documents, such as operating manuals, troubleshooting checklists, and product specifications, and crucially, does not contain proprietary, sensitive customer, or business information. This discrepancy between the threat actor’s claims and Abbott’s assessment highlights a common challenge in post-breach communication, where the perceived value and sensitivity of exfiltrated data can differ significantly between the victim and the attacker.
As of the current reporting, neither ShinyHunters nor ShadowByt3$ has publicly released the data they claim to have stolen from Abbott. This waiting period often signifies ongoing negotiation attempts or strategic timing for maximizing pressure on the victim organization. The dual nature of these incidents — one involving confirmed unauthorized access to internal systems and the other concerning claims against an external portal — presents a complex challenge for Abbott, requiring a multi-pronged investigative and defensive response.
These incidents are emblematic of broader trends in the cybersecurity landscape, particularly the increasing targeting of the medical technology sector. Organizations in this domain are attractive to cybercriminals due to the highly sensitive nature of patient health information, the critical role their products play in healthcare infrastructure, and the potential for lucrative intellectual property theft. The use of social engineering tactics like vishing to compromise SSO accounts demonstrates a growing sophistication among threat actors, who are increasingly bypassing traditional perimeter defenses by targeting human vulnerabilities. Legacy systems, as highlighted in the Cancer Diagnostics incident, also represent a persistent security risk, often lacking modern security controls and patching mechanisms.
The LabCentral incident, if the threat actor’s claims about intellectual property theft are accurate, underscores the significant risks associated with third-party portals and supply chain vulnerabilities. Even if no direct patient data is compromised, the theft of manufacturing certificates, technical specifications, and regulatory documents could have substantial implications for competitive advantage, product integrity, and compliance. The differing statements from Abbott and the threat actors regarding the sensitivity of the LabCentral data will require careful scrutiny as investigations proceed, potentially impacting regulatory obligations and public trust.
In light of these events, the medical technology industry faces an imperative to bolster its cybersecurity defenses. This includes implementing robust multi-factor authentication across all systems, enhancing employee security awareness training to counter sophisticated social engineering attempts, conducting regular penetration testing and vulnerability assessments, and strategically modernizing legacy IT infrastructure. Furthermore, comprehensive third-party risk management programs are crucial to ensure that external portals and vendors adhere to stringent security standards. The ongoing investigations into these Abbott incidents will likely provide valuable insights into the evolving tactics of cybercriminals and the critical measures required to safeguard sensitive data and critical operations within the healthcare ecosystem.
Lisa Mariana
Aura Kasih
Ayu Aulia
