ShinyHunters Claims 7.1 Million Baxter International Records Leaked
Extortion gang ShinyHunters claims to have leaked 7.1 million Salesforce records stolen from medical device maker Baxter International, including sensitive personal information.
The notorious extortion gang ShinyHunters has once again targeted the healthcare sector, announcing on its dark web site that it has leaked 7.1 million Salesforce records pilfered from medical device manufacturer Baxter International. The stolen data reportedly includes personally identifiable information (PII), marking a significant data exfiltration event.
ShinyHunters posted a message on Wednesday stating, "The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care," accompanied by a download link for the alleged stolen data. This aggressive tactic is characteristic of the group's modus operandi, aiming to pressure victims into paying ransoms.
Baxter International, headquartered in Deerfield, Illinois, acknowledged in an August 13 statement that it had recently identified "unauthorized activity" affecting certain third-party applications. However, the company's statement did not directly mention ShinyHunters or confirm the specific claims regarding Salesforce records. Baxter emphasized that its manufacturing, customer operations, and patient services remained unaffected, and the company continues to operate normally.
"We have no evidence that this activity affected Baxter products, connected solutions or technologies used by customers to deliver patient care. Healthcare providers and customers can continue using Baxter products and connected solutions as intended," Baxter assured its stakeholders. Following the discovery of suspicious activity, Baxter initiated its cybersecurity response protocols and engaged independent forensic specialists to investigate the nature and scope of the potential data access or acquisition.
The company stated that the investigation is ongoing and did not anticipate a material impact on its financial or operational results, despite reporting global net sales of $11.24 billion in 2025. Baxter did not immediately respond to requests for further comment on ShinyHunters' specific claims.
This incident places Baxter among a growing list of healthcare sector victims attributed to ShinyHunters. Previously, the gang claimed responsibility for leaking 234 gigabytes of data affecting 2.6 million individuals from DentaQuest, a major U.S. dental and vision benefits administrator. DentaQuest later reported the incident to federal regulators, stating it affected 15 million people, making it one of the largest health data breaches reported in 2026.
Other alleged victims in the healthcare space include One Medical Group, an Amazon unit, from which ShinyHunters claimed to have stolen and leaked 8.8 terabytes of data in June. One Medical reported the incident affecting over 153,000 people, stemming from unauthorized access to a third-party file-storage system used for archived information.
Beyond healthcare, ShinyHunters has targeted organizations across various sectors, including education, retail, and manufacturing. The group has also been implicated in exploiting a zero-day vulnerability in Oracle PeopleSoft, leading to an active extortion campaign impacting over 100 organizations globally.