ShinyHunters Claims Medtronic Data Breach Affecting Millions of Patients
Medical device manufacturer Medtronic has begun notifying patients of a data breach claimed by the ShinyHunters ransomware group, which alleges the theft of over 9 million records.
Medical device giant Medtronic is initiating notifications to patients whose personal and health information was compromised in a data theft incident that occurred in April. The ransomware group ShinyHunters has claimed responsibility, asserting that it exfiltrated more than 9 million records from the company's systems.
Publicly available records indicate that Medtronic, headquartered in Minnesota, informed Massachusetts regulators that the breach affected approximately 64,000 patients in that state alone. As of late June, official breach reports related to this incident had not yet been posted on federal regulatory platforms, such as the U.S. Department of Health and Human Services' HIPAA Breach Reporting Tool, which tracks breaches impacting 500 or more individuals.
ShinyHunters first publicized its claim on April 17, alleging on a Tor network site that it had successfully breached a Medtronic database. The group stated it had stolen over 9 million records containing personally identifiable information, alongside terabytes of internal corporate data. They issued a ransom demand, threatening to release the stolen data if Medtronic did not comply by April 21.
Medtronic acknowledged the breach in a public statement on April 24 and also informed the U.S. Securities and Exchange Commission about the compromise of its corporate IT systems. By the end of April, the listing for Medtronic on ShinyHunters' dark web site was reportedly removed, suggesting a potential resolution or negotiation.
In an updated statement, Medtronic confirmed the breach of "some" of its corporate IT systems, emphasizing that its investigation is ongoing. The company stated it has begun communicating with individuals whose information is believed to have been impacted. Medtronic has also asserted that there is no evidence to suggest that the compromised data has been publicly posted or exposed online.
Crucially, Medtronic has reported no identified impact on its product security or patient safety, assuring that its devices continue to operate safely and deliver intended therapies. Similarly, the company has not detected any disruptions to its manufacturing, distribution operations, or its capacity to meet patient and customer needs.
To assist affected individuals, Medtronic is offering 24 months of complimentary credit monitoring, dark web monitoring, and identity theft restoration services. The company has also advised physicians to contact their local Medtronic representative for any specific concerns.
Despite Medtronic's assurances regarding operational and safety impacts, the company is already facing multiple proposed federal class-action lawsuits filed by patients, including those with cardiac devices. These lawsuits allege negligence and other claims against Medtronic in the wake of the recent hack.
Medtronic's notification sample, dated April 15, 2026, confirms that an unauthorized actor accessed certain corporate IT systems between April 13 and April 19, 2026. The exposed data may include full name, contact information, date of birth, Social Security number, and health-related information. While ShinyHunters initially listed Medtronic on their dark web extortion portal and threatened to release over 9 million records, the listing was later removed, and Medtronic assures that its devices remain unaffected and the stolen data was not exposed online.
Medtronic has officially confirmed the breach of its corporate IT systems, detailing that the intrusion occurred over a six-day period from April 13-19, 2026. While the company stated that patient data including names, contact information, dates of birth, Social Security numbers, and health details may have been accessed, it emphasized that its medical devices were not affected and continue to operate normally. Medtronic is offering affected individuals 24 months of complimentary identity protection services and is working with law enforcement and regulators.
Medtronic has begun notifying affected patients more than two months after the April cyberattack, detailing that personal and health information may have been compromised. While the company states no devices were impacted and there is no evidence of public data exposure, the extortion group ShinyHunters had previously claimed to have stolen over nine million records. The notification also leaves several questions unanswered, including the exact number of affected individuals and the initial access vector used by the attackers.
Medtronic has confirmed that the data breach, attributed to the ShinyHunters extortion group, impacts over 3.8 million individuals. The incident, which occurred in April 2026, involved unauthorized access to the company's corporate IT systems, leading to the compromise of personal and medical information. The company is in the process of notifying all affected individuals.
Medtronic has begun notifying affected individuals, with the California Attorney General releasing a copy of the notification letter on June 29. The letter details that Social Security numbers, health-related data, names, contact information, and dates of birth were accessed by hackers. The company is offering 24 months of free credit monitoring and identity theft restoration services to those impacted.