Abbott Laboratories is currently investigating two distinct cybersecurity incidents, one of which the company has confirmed involved unauthorized access to internal systems within its Cancer Diagnostics business. The second incident involves claims by a separate threat actor regarding a breach of the company's LabCentral customer portal.
The confirmed incident in the Cancer Diagnostics business follows an extortion attempt by the ShinyHunters group, which listed Abbott on its data leak site. ShinyHunters initially set a deadline of July 18 for data publication if negotiations did not occur, later extending it to July 21. Abbott stated that the unauthorized access was limited to a small number of internal legacy Exact Sciences systems, which are separate from other Abbott businesses and systems. The company emphasized that this incident has not affected any business operations, product availability, manufacturing, lab operations, or its ability to serve patients. Abbott has initiated its incident response protocols, engaged cybersecurity experts, and notified law enforcement, adding that it does not anticipate a material impact on its business or financial results.
ShinyHunters claims to have gained access in mid-June through a vishing attack targeting multiple Abbott employees. This allegedly led to the compromise of a Microsoft Entra single sign-on (SSO) account, providing access to internal systems. The group further claims to have exfiltrated data from Microsoft Entra, ServiceNow, SharePoint, Databricks, and Coupa, including internal documents, contracts, and customer information. Specifically, ShinyHunters asserts it stole over 30 million rows of customer personally identifiable information (PII), encompassing names, email addresses, phone numbers, physical addresses, and dates of birth, along with more than one million Social Security numbers. The group also claims to possess over 22 million client notes detailing doctor-patient conversations, more than 20 million medical orders, and customer agreements and non-disclosure agreements. These claims regarding the stolen data have not been independently verified.
The second incident involves a threat actor identified as ShadowByt3$, who claims to have breached Abbott's Core Laboratory diagnostics business via its LabCentral customer portal. ShadowByt3$ alleges gaining access on July 4, 2026, by exploiting a "weak point" in the environment using compromised customer credentials, subsequently exfiltrating files through API endpoints. The group claims to have stolen CE manufacturing certificates, operation manuals, technical specifications, regulatory documentation, product requirement archives, calibrator value assignments, assay files, and other product documentation related to Abbott's laboratory diagnostic systems. ShadowByt3$ states that no customer data was compromised but asserts possession of sensitive business documents and intellectual property, providing screenshots and a file listing as purported evidence.
Abbott has acknowledged awareness of this "potential" cyber incident but disputes the characterization of the data ShadowByt3$ claims to have stolen. The company stated that LabCentral is an externally facing, third-party hosted portal used by its core laboratory diagnostics business, which contains publicly available technical product reference documents such as operating manuals, troubleshooting checklists, and product specifications. Abbott maintains that this portal does not house proprietary, sensitive customer, or business information.
As of now, neither ShinyHunters nor ShadowByt3$ has publicly released any data they claim to have stolen from Abbott.
