The Low-Tech Breach of High-Tech Diagnostics

In the world of biotech, the focus is typically on the cutting edge of science. But as the recent breach of Abbott’s cancer diagnostics business demonstrates, as first reported by The Register, the most dangerous vulnerability isn't a failure of the science—it's a failure of human psychology.

According to reporting from The Register, the intrusion began not with a sophisticated software exploit or a zero-day vulnerability, but with a 'vishing' attack. In this low-tech social engineering maneuver, members of the ShinyHunters extortion crew simply called employees and tricked them into granting system access. It is a stark reminder that while the diagnostic tools are high-tech, the security perimeter is often only as strong as a single phone call.

Abbott, which acquired the cancer diagnostics firm Exact Sciences earlier this year, first disclosed the security incident on July 16. By August 5, the company acknowledged that accessed files contained personal and health information, though it noted the event was not an encryption malware attack. Abbott maintained that the breach was limited to a few internal systems and did not disrupt laboratory operations, manufacturing, patient services, or products.

However, the scale of the data exfiltration claimed by the attackers suggests a systemic failure once the initial perimeter was breached. The Register reports that ShinyHunters published 10.9 million unique email addresses on the dark web after Abbott apparently declined to pay a ransom. The leak includes phone numbers, physical addresses, dates of birth, genders, names, and personal health information belonging to patients, healthcare providers, and customers.

***

**Opinion:** *This is a textbook example of the 'human firewall' problem. We invest billions into the precision of cancer diagnostics, yet the gateway to that data can be opened by a convincing voice on a telephone. Until healthcare giants prioritize aggressive social engineering training over mere software patches, they remain open to these low-effort, high-impact attacks.*

***

Beyond the email addresses, the claims made by ShinyHunters are staggering. The group asserts they stole over 30 million rows of customer data, including more than one million Social Security numbers and 7.5 million dates of birth. More critically, the crew claims to have seized over 20 million medical-order records—detailing refill information, prescription types, order dates, and patient IDs—and more than 22 million rows of confidential doctor-patient notes.

ShinyHunters further claims to have siphoned 130,000 files from SharePoint, 89,000 contracts from Coupa, and over 425 million rows of data from Databricks, though The Register notes these specific figures have not been independently verified.

As of its latest update, Abbott states its investigation is ongoing and that it will notify affected individuals as required. However, the company has not yet clarified how the vishing attack transitioned into a massive data theft, how long the intruders maintained access, or whether a formal extortion demand was ever received. For the millions of individuals whose data is already in the wild, the corporate investigation may be a case of too little, too late.