Abbott Cancer Diagnostics Data Leaked After Ransom Demand

Data stolen from Abbott's cancer diagnostics business, Exact Sciences, has been published online after the healthcare giant reportedly refused to pay a ransom, according to reporting from The Register.

Abbott first disclosed the security breach on July 16, later explaining on August 5 that the intrusion began with a vishing attack. While Abbott stated the event did not involve encryption malware and did not disrupt laboratory operations, manufacturing, or patient services, the extortion group ShinyHunters claims the company failed to reach a ransom agreement despite multiple opportunities.

According to The Register, the leaked data includes 10.9 million unique email addresses, as well as names, phone numbers, physical addresses, genders, and dates of birth. ShinyHunters claims to have stolen more than 30 million rows of customer information, which allegedly includes over one million Social Security numbers and 7.5 million dates of birth.

More sensitive claims involve the theft of over 22 million rows of client notes featuring confidential doctor-patient conversations and health information, alongside more than 20 million medical-order records containing prescription types, refill information, and patient IDs. The group also claims to have taken 130,000 files from SharePoint, 89,000 contracts from Coupa, and over 425 million rows of data from Databricks, though these specific figures remain unverified.

Abbott has not disclosed the duration of the intruders' access, the specific path from the vishing attack to the data theft, or whether it received a formal extortion demand. The company stated its investigation is ongoing and that it will notify affected individuals as required.