ShinyHunters has published data stolen from Medela, the Swiss maker of breast pumps and medical devices, after the company let an extortion deadline pass. Have I Been Pwned (HIBP) added the dataset on 30 September 2026 and counts 423,947 compromised accounts. HookPhish and AliasFleet repeat that figure, and HookPhish and Yazoul round it to about 424,000 unique email addresses. Most records belong to healthcare professionals, Medela staff and sales leads. They hold corporate contact details such as names, employers, job titles, phone numbers and physical addresses, and some include linked support tickets. All eight sources for this brief are third-party reporting or analysis. None is a primary source. As of publication, none of the sources reports any public statement from Medela, and no one has publicly established how the attackers got in.
What Happened
The extortion phase of this incident is well documented. The source of the data is not.
- The leak-site listing: ShinyHunters posted Medela on its data leak site as a "final warning" and gave the company until 8 September 2026 to make contact. Sources disagree on the listing date by one day. BreachNews dates it to 6 September. SOCRadar, DeXpose and AliasFleet date it to 7 September, and 7 September is also the breach date HIBP records, according to HookPhish.
- The threat: DeXpose quotes the listing: "This is a final warning to reach out by 08 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline." BreachNews describes that phrase as a threat of further, unspecified digital disruption.
- No proof at first: BreachNews reported that the first listing included no data samples, no volume claim and no account of how the intrusion happened.
- Publication: The deadline passed and the data was published. HIBP indexed it on 30 September.
Yazoul states plainly that "Medela did not pay." That appears to be an inference from the data being published, not something Medela has confirmed. Some sources, including DeXpose and SOCRadar, call ShinyHunters a "ransomware" group. AliasFleet notes that no ransomware deployment on Medela's systems has been confirmed. Proven Data says the group's documented extortion cases have not involved file encryption.
What Was Taken
According to HIBP's breach listing, as reported by HookPhish and AliasFleet, the dataset contains:
- Email addresses (about 424k unique)
- Full names and salutations
- Employer names and job titles
- Phone numbers
- Physical addresses
- Support tickets linked to some records
No source reports passwords, payment card data, government ID numbers or clinical or patient data in the leak. The dataset looks like a CRM or customer-support contact store, not a clinical system. That fits the SaaS-focused data theft ShinyHunters is known for, but no source has confirmed which platform the data came from.
SOCRadar separately reports 25 records tied to medela[.]com in its own telemetry. These include employee credentials on login.medela[.]com and brand.medela[.]com, plus one corporate address seen on a third-party governance SaaS platform, with records dating from March 2024 to 7 September 2026. These are SOCRadar's own findings, not part of the leaked dataset. They show credential exposure around Medela, but they do not establish how the attackers got in.
Why It Matters
A ready-made phishing list for healthcare. The leaked records are worth more for targeting than for fraud. Each one combines a person's name, employer, job title and direct contact details. Yazoul notes that procurement staff, lactation consultants, hospital supply-chain managers and anyone who contacted Medela support could be in the file. With this data, attackers can impersonate a medical device supplier convincingly. Expect fake invoices, fake product-recall notices, fake "support ticket follow-up" emails and vishing calls aimed at hospital purchasing teams.
Part of a healthcare campaign. BreachNews reports that ShinyHunters named McKesson, Neogen, Jack Henry and Elekta in August 2026. SOCRadar says the group claimed 22 other victims in the 60 days before the Medela listing, concentrated in healthcare, technology and financial services in the US, Switzerland and Israel. It places Medela fifth in a cluster of Swiss and healthcare companies that includes Alcon, Elekta, McKesson and NovoCure.
No ransomware needed. This case shows the pay-or-leak model in its simplest form: steal the data, set a deadline, publish. Organisations that treat ransomware readiness as mainly a backup problem will miss this kind of threat.
The Attack Technique
How the attackers got into Medela is unknown. No source identifies the entry point or how long the attackers had access, and AliasFleet warns readers to distrust anyone claiming to know.
What is documented is how the group usually operates, based on threat profiles from Proven Data and SecPod:
- Vishing for SSO access: callers posing as IT support persuade staff to hand over SSO credentials and MFA codes.
- OAuth token abuse: the group steals tokens from third-party integrations connected to Salesforce, Microsoft 365, Google Workspace and similar platforms.
- Overly open SaaS settings: Proven Data lists over-permissive Salesforce Experience Cloud guest access as one route.
- Exploiting internet-facing applications: SecPod's most directly attributed example is CVE-2026-35273 in Oracle PeopleSoft PeopleTools, exploited between 27 May and 9 June 2026, before it was publicly disclosed.
- Valid accounts and stolen credentials, followed by discovery, staging and exfiltration.
MITRE tracks the group as G1057 and lists UNC6240 and Bling Libra as associated groups. Proven Data reports that the group has an encryptor in development, called ShinySp1d3r, but no documented attack has used it.
Given what was taken (contact records and support tickets), compromise of a CRM or helpdesk platform is a reasonable hypothesis for defenders to test. It has not been confirmed.
What Organizations Should Do
- Treat Medela-themed messages as suspicious. Healthcare organisations should warn procurement, clinical-engineering and lactation teams about emails and calls that claim to come from Medela or its distributors, especially ones involving invoices, payment changes, recalls or support tickets. Check them through a known phone number.
- Audit connected apps on your SaaS platforms. Review OAuth grants and third-party integrations on CRM and helpdesk systems. Revoke tokens that are stale or broader than needed, and turn off guest or public access to Experience Cloud and support portals.
- Make help-desk resets resistant to vishing. Require out-of-band identity checks before resetting MFA or SSO. Alert on new MFA device enrolments that follow a help-desk call.
- Patch internet-facing applications. Prioritise PeopleSoft (CVE-2026-35273) and other systems exposed to the internet that ShinyHunters has been reported to exploit.
- Watch for leaked credentials. As SOCRadar's Medela findings show, employee credentials for corporate portals often end up in stealer logs well before an extortion attempt. Track exposure of your own domains and force resets when credentials appear.
- Check whether your staff are in the leak. Run your corporate domain through HIBP's domain search to find affected employees, then send them targeted phishing-awareness guidance.
Sources: Medela Data Breach (2026): 423,947 Accounts Leaked - AliasFleet | ShinyHunters Claims Medela Breach, Threatens Data Leak | Medela Data Breach Healthcare Data Breach Intelligence SOCRadar®... | ShinyHunters Compromises Medela.com - DeXpose | Critical Alert: Recent Medela Data Breach | Medela Breach: 424K Healthcare Contacts Leaked (2026) | ShinyHunters: Attack Lifecycle, IOCs, and Incident Response Guide | Inside the ShinyHunters Playbook: From Credential Theft to Data Ext...