Abbott Laboratories confirmed on 16 July 2026 that attackers gained unauthorized access to legacy Exact Sciences systems inside its Cancer Diagnostics business, days after the ShinyHunters extortion crew posted the cancer-screening firm to its leak site with a countdown. Abbott's own statement is deliberately narrow: unauthorized access to "a limited number of internal systems in our Cancer Diagnostics business only," with no impact to operations, manufacturing, lab work or patient service, and no expected material financial impact. What was taken is where accounts diverge sharply. ShinyHunters told BleepingComputer it holds more than 30 million customer records; a widely circulated "109 million records" headline from Undercode News is not supported by that outlet's own body text, which describes roughly 10.9 million email addresses surfacing via Have I Been Pwned. Abbott has confirmed neither figure.
What Happened
The victim entity is Exact Sciences Corporation, the cancer screening and precision oncology company behind Cologuard and Oncotype testing, which Abbott acquired and folded into its diagnostics arm. Sources differ slightly on timing: HEAL Security and Breached.Company place the acquisition in late 2025, while CTIPilot refers to a 2026 acquisition. Abbott stresses that the compromised legacy Exact Sciences environment is separate from Abbott's core infrastructure.
The timeline, as far as it can be reconstructed from reporting, runs like this. ShinyHunters claims the intrusion began with voice phishing against several employees in mid-June 2026. Abbott published its incident statement on 16 July after the group listed the company publicly. ShinyHunters initially threatened to publish after 18 July, then extended the deadline to 21 July. HEAL Security reports that Abbott negotiated with the group and that, as of 20 July, the stolen data had not been leaked, with no public confirmation of whether any payment was made.
A second, unrelated claim complicates the picture. A separate actor calling itself ShadowByt3$ alleged compromise of Abbott's externally facing LabCentral portal. BleepingComputer reports that portal houses publicly available technical product reference documents and contains no proprietary or sensitive customer data. Abbott is investigating both incidents but has linked neither to the other.
What Was Taken
Nothing about the stolen dataset has been confirmed by Abbott, which has said only that it continues to investigate what information was accessed. Every volumetric figure below originates with the threat actor or with secondary trackers, and should be read accordingly.
ShinyHunters' leak-site posting and its statements to BleepingComputer claim more than 30 million rows of customer personal data covering names, email addresses, phone numbers, physical addresses and dates of birth, plus over 1 million Social Security numbers. The group further claims more than 22 million client notes containing doctor-patient conversations, over 20 million medical orders, and a body of internal contracts and NDAs. It says data was pulled from Microsoft Entra, ServiceNow, SharePoint, Databricks and Coupa.
The record counts genuinely conflict. Reports range from "more than 30 million" customer records (ShinyHunters, via BleepingComputer, CTIPilot, Breached.Company and HEAL Security) to a claimed 109 million records in the Undercode News headline, whose own article text instead describes approximately 10.9 million email addresses published and indexed by Have I Been Pwned. Only Undercode News asserts that publication has occurred at all; HEAL Security explicitly stated the data had not been leaked as of 20 July. That is an unresolved contradiction, not a rounding difference, and defenders should treat the 109 million figure as unverified until Abbott or a breach-notification filing substantiates a count.
CTIPilot puts it plainly: the record counts and the specific SaaS platforms are the actor's unverified claim, not Abbott's confirmation.
Why It Matters
Oncology diagnostics data is close to a worst case for victims. A dataset combining identity fields, Social Security numbers, medical orders and transcribed doctor-patient notes supports identity theft, insurance fraud, and highly convincing targeted social engineering against people who are, by definition, seriously ill. Unlike credentials, a cancer diagnosis cannot be rotated. The exposure window for affected individuals is effectively permanent.
The structural lesson is about acquisitions. Abbott's defense of its own perimeter is that the legacy Exact Sciences systems are separate from Abbott's. That separation limited blast radius, and it worked. But it also describes an inherited environment that came with its own identity provider trust, its own SaaS estate and its own legacy access paths, and that is exactly where the attacker landed. Post-merger integration debt is now a first-class attack surface.
Finally, the extortion mechanics are worth noting. Abbott reportedly negotiated, the deadline slipped twice, and the data has not surfaced through the group's own channels. Whether that reflects a payment, a stall, or an inflated claim is not publicly known.
The Attack Technique
ShinyHunters, tracked by some vendors under the alias UNC6240, told BleepingComputer it compromised a Microsoft Entra ID single sign-on account through vishing calls to Abbott employees in mid-June. From that one federated identity, the actor claims lateral reach into connected SaaS applications and legacy Exact Sciences systems. Rescana's analysis describes the same chain: social engineering over the phone to capture credentials or MFA codes, then abuse of the resulting SSO session.
Microsoft's own research, published 13 July 2026, is the highest-confidence source on this tradecraft and corroborates the pattern independently of the Abbott case. Between mid-2025 and mid-2026 Microsoft observed activity with overlapping tradecraft commonly associated with ShinyHunters using two primary intrusion paths: vishing aimed at obtaining OAuth consent, and supply chain compromise through trusted workflow integrations such as Salesloft and Gainsight. Both paths let the actor inherit user and application privileges, enumerate and query CRM records at scale, and evade conventional authentication detections because the access looks like an already-authorized application. Microsoft is explicit that this is not a Salesforce vulnerability; it is abuse of trusted OAuth relationships for access, exfiltration and persistence.
That distinction matters operationally. There is no patch. The detection surface is consent grants, token usage and application-level telemetry, not failed logins.
What Organizations Should Do
- Harden the help desk and identity recovery flow against voice social engineering. Require callback verification or in-band manager attestation before any MFA reset, device enrollment or SSO account change. This is the single control that would have broken the reported kill chain.
- Inventory and constrain OAuth-connected applications. Enumerate every consented third-party app against Entra ID and your SaaS platforms, remove dormant grants, and restrict user consent so new integrations require admin approval. Microsoft's guidance points directly at monitoring OAuth-connected apps and validating third-party integrations.
- Turn on the telemetry that actually sees this. Enable Salesforce event monitoring and equivalent audit logging across ServiceNow, SharePoint, Databricks and procurement platforms, and route it somewhere alerting fires. Microsoft has worked with Salesforce to add near-real-time detection with connected-application attribution in Defender for Cloud Apps.
- Alert on bulk query and export behaviour, not just logins. A compromised SSO session authenticates cleanly; what gives it away is volume. Baseline normal record-retrieval rates per identity and per application, and flag deviations.
- Treat acquired environments as untrusted until proven otherwise. Legacy systems inherited through M&A need their own identity review, conditional access policy and segmentation from the acquiring organisation's estate before integration, not after.
- Assume phishing-resistant MFA is the goal. Move privileged and high-blast-radius accounts to FIDO2 or certificate-based authentication, which cannot be relayed by a caller reading codes over the phone.
Abbott has engaged third-party incident responders and notified law enforcement, and no public indicators of compromise have been released. Organisations in healthcare and diagnostics should treat the Microsoft advisory as the actionable artifact here, since the tradecraft it documents is being reused across sectors including retail, education and manufacturing.
Sources: Exact Sciences Data Breach Exposes 109 Million Records as ShinyHunt... | Defending SaaS-based applications against ShinyHunters OAuth abuse... | Abbott probes two cyber incidents amid extortion claims | Abbott confirms a Cancer Diagnostics cyber incident; ShinyHunters c... | ShinyHunters Claims 30 Million Records from Abbott's Cancer Diagnos... | ShinyHunters Claims Breach of Exact Sciences Corporation | Abbott Laboratories Cybersecurity Breach Analysis: ShinyHunters Att... | Abbott Investigating Cyberattack Claims From Two Threat Actors - HE...