Medtronic Confirms Data Breach After ShinyHunters Claims 9 Million Patient and Corporate Records

Summary

Medical device giant Medtronic has confirmed unauthorized access to its corporate IT systems after the ShinyHunters hacking group claimed to have exfiltrated over 9 million records. The company publicly acknowledged the breach on April 24, 2026, following ShinyHunters listing Medtronic on its leak site in mid-April.

ShinyHunters — the same group behind the massive Canvas LMS breach affecting 275 million students — claims the stolen data includes personal information alongside large volumes of internal corporate data. Medtronic has not confirmed the exact scope but stated that the intrusion was limited to specific corporate IT environments. Crucially, the company asserts that its medical devices, patient safety systems, and manufacturing operations were not impacted, and that hospital networks used by customers are independently managed.

ShinyHunters initially set a ransom deadline and threatened to publish the data, but subsequently removed Medtronic from its leak site — potentially indicating negotiations or other behind-the-scenes developments. Multiple law firms have launched investigations, and Medtronic has stated it will notify affected individuals and offer support services if sensitive data exposure is confirmed.

Source

BleepingComputer | SecurityWeek | HIPAA Journal

Commentary

ShinyHunters is having an extraordinarily prolific 2026. Between the Canvas LMS mega-breach and now Medtronic, they are demonstrating both the capability and willingness to target diverse high-value sectors. The healthcare angle makes this particularly sensitive — even if medical devices were not compromised, corporate records at a company like Medtronic can contain clinical trial data, employee health information, and proprietary research.

The removal of Medtronic from ShinyHunters’ leak site without a public data dump could mean several things: ransom payment, ongoing negotiation, or a strategic decision to hold the data for more targeted exploitation. None of those scenarios are comforting. Healthcare organizations should be treating ShinyHunters as a Tier 1 threat actor at this point and reviewing their own exposure to third-party and supply-chain compromise vectors.