American healthcare giant Abbott Laboratories is investigating two apparently unrelated cyber incidents disclosed within days of each other, with the ShinyHunters extortion gang claiming theft of more than 22 million doctor-patient notes and a separate actor, ShadowByt3$, claiming access to the company's LabCentral portal. Abbott has confirmed unauthorized access to a limited number of internal systems in its Cancer Diagnostics business, while stating that no customer, operational, or financial impact has been observed and that no claimed stolen data has been published.
What Happened
On July 16th, Abbott confirmed it was investigating an incident involving unauthorized access to a limited number of internal systems within its Cancer Diagnostics business. The company stressed that no other business units, products, or operations were affected, and that legacy Exact Sciences systems inherited through its acquisition of the Exact Sciences cancer diagnostics business remain separate and were not impacted.
The ShinyHunters gang subsequently listed Abbott on its data leak site, threatening to publish the allegedly stolen data on July 18th unless the company negotiated. That deadline was later postponed to July 21st, a common pressure tactic in extortion-driven operations.
Separately, a second threat actor calling itself ShadowByt3$ claimed to have breached Abbott's LabCentral portal, a customer portal for core laboratory diagnostics, on July 4th using compromised customer credentials. Abbott has downplayed this claim, stating the portal holds public reference materials rather than sensitive data. Although the two disclosures appear unrelated, their near-simultaneous timing has drawn heightened scrutiny to Abbott's overall security posture.
What Was Taken
ShinyHunters claims the stolen dataset from the Cancer Diagnostics intrusion includes internal documents, contracts, customer information, customer agreements, and NDAs. The most alarming figures cited by the group are more than 22 million doctor-patient notes containing conversations and over 20 million medical orders.
The gang further claims the customer data contains names, email addresses, phone numbers, physical addresses, and dates of birth, along with more than one million Social Security numbers. If accurate, this represents a high-volume trove of protected health information and personally identifiable information with direct value for identity theft, insurance fraud, and targeted social engineering.
Abbott has not confirmed the scope of any data exposure and says no material impact on the business or financial results is expected. None of the claimed stolen data has been released at the time of reporting, meaning the volume and sensitivity figures remain attacker assertions pending verification.
Why It Matters
Healthcare organizations remain among the most targeted verticals because patient records combine medical, financial, and identity data that cannot be reset like a password. A claimed 22 million clinical notes and over one million Social Security numbers would place this among the more significant healthcare exposures if substantiated.
The dual-incident nature is also instructive. Two separate actors surfacing in the same window signals that large healthcare enterprises present a broad, distributed attack surface spanning acquired legacy systems, corporate identity infrastructure, and customer-facing portals. Defenders should treat the ShinyHunters intrusion as the priority given its confirmed unauthorized access and the sensitivity of the claimed data, while not dismissing credential-based portal claims outright.
The Attack Technique
ShinyHunters told reporters it gained access through a vishing campaign targeting several Abbott employees in mid-June. During the attack, the gang compromised a corporate Microsoft Entra single sign-on account and then pivoted to steal data from connected applications tied to that identity.
This aligns with ShinyHunters' established playbook of voice-phishing employees to capture SSO credentials or MFA approvals, then abusing the trust a single federated identity grants across an enterprise's cloud application ecosystem. The separate ShadowByt3$ claim reportedly relied on compromised customer credentials to reach the LabCentral portal, a simpler credential-reuse or theft vector distinct from the Entra compromise.
What Organizations Should Do
- Harden identity against vishing by enforcing phishing-resistant MFA such as FIDO2 or hardware keys, and require secondary verification for any help-desk credential or MFA reset requests.
- Apply conditional access and least-privilege scoping in Microsoft Entra so a single compromised SSO account cannot reach broad swaths of connected applications and data stores.
- Audit and monitor OAuth and application connections tied to SSO identities, revoking stale or over-permissioned app grants that expand blast radius after an account takeover.
- Train employees specifically on voice-based social engineering, including callback verification procedures, since vishing bypasses many email-focused controls.
- Enforce unique credentials and MFA on all customer-facing portals, and monitor for credential-stuffing and reuse against those login endpoints.
- Segment and inventory acquired and legacy systems so inherited infrastructure is brought under the same monitoring, patching, and access-control standards as core systems.
Sources: Medical giant Abbott investigates two cyber incidents as ShinyHunters claims breach | Cybernews