Medtronic began notifying affected individuals of a data breach involving certain corporate IT systems, according to Medtronic’s updated statement on June 29, 2026. The extortion group ShinyHunters has claimed responsibility for the attack, per ShinyHunters’ own leak-site post.
Quick Summary – TLDR:
- Medtronic confirmed an unauthorized actor accessed certain corporate IT systems from April 13 to April 19, 2026, and has notified affected individuals.
- ShinyHunters listed Medtronic on its dark-web extortion portal on April 18, 2026, claiming to hold 9 million records, a figure Medtronic has not validated.
- State regulator filings confirm more than 369,200 individuals affected across Texas, Massachusetts and Vermont, though Medtronic has not disclosed a company-wide total, per TechTarget’s review of the filings.
- Exposed data includes full names, contact information, dates of birth, Social Security numbers and health-related information.
- Medtronic is offering affected individuals 24 months of complimentary credit monitoring, dark-web monitoring and identity-theft restoration through a dedicated call center, per Medtronic’s newsroom statement.
What Happened?
Medtronic’s own statement confirmed the company notified an undisclosed number of patients about unauthorized access to its corporate IT systems that occurred in April 2026. The company discovered unusual activity on April 15, 2026, and Medtronic’s own statement said its investigation determined that an unauthorized actor accessed certain systems over a six-day window.
Medtronic said it contained the incident immediately, activated its incident response protocols and engaged external cybersecurity experts, per its statement on unauthorized system access.
Medtronic said in the statement, first issued in April and updated this week.
Before the intrusion window closed, ShinyHunters listed Medtronic on its dark web extortion portal, claiming to hold 9 million Medtronic records and threatening to release the stolen data unless a ransom was paid within days. The listing was later removed from the portal, and no ransom amount was disclosed. Medtronic has not validated ShinyHunters’ claim of 9 million records.
Confirmed Numbers vs. the Claimed Figure
State regulator filings disclosed impacted individuals by state: more than 297,000 in Texas, 63,500 in Massachusetts and 8,700 in Vermont, totaling more than 369,200 disclosed across those three states. Medtronic has not disclosed a company-wide total number impacted.
Medtronic, a leading medical device manufacturer, has confirmed a data breach affecting its corporate IT systems. Sensitive patient information, including names, contact details, and health data, may have been exposed. The company is offering 24 months of complimentary identity… pic.twitter.com/NRdN2MDZeq
— The Daily Tech Feed (@dailytechonx) July 2, 2026
A leak-site claim is pressure for a ransom deadline, not an audited figure; state regulator filings are the legal disclosures tied to confirmed breached record counts. Three states already total more than 369,200, well short of the unvalidated 9 million ShinyHunters posted.
Exposed data includes full name, contact information, date of birth, Social Security number and health-related information. Medtronic said it has no evidence that impacted information was publicly posted or exposed online.
Device Safety Stays Separate From the IT Breach
Medtronic said it has not identified any impact to product security or patient safety, and the company emphasized that all its devices remain safe to use and are not affected. Medtronic also reported no impact to manufacturing or distribution operations, its ability to serve customers, or its financial reporting systems.
The intrusion reached corporate IT systems that store patient and employee records, not the firmware or connectivity layers behind implanted or hospital-deployed devices. That split shapes the risk. A firmware-level breach would carry clinical risk, while a records breach carries identity-theft and fraud risk instead.
Medtronic operates in 150 countries, with $33.5 billion in annual revenue and 95,000 employees, a scale that puts a large volume of stored records inside even a bounded corporate-IT compromise. ShinyHunters recently claimed a separate cyberattack against Amazon’s One Medical Senior Health, threatening to leak patient data unless paid, a second named healthcare target hit with the same claim-a-count.
What’s Next?
Affected individuals should watch for mailed notification letters covering the 24 months of complimentary credit monitoring, dark-web monitoring and identity-theft restoration services Medtronic is offering. Questions can go to the dedicated call center at (888) 289-6806, available Monday through Friday, 9 a.m. to 9 p.m. ET. Medtronic said it is implementing additional safeguards.
That monitoring helps affected individuals catch signs of misuse faster; it does not prevent misuse of data already exposed. More states are likely to file breach notifications in the coming weeks, narrowing the gap between the confirmed 369,200+ and Medtronic’s undisclosed total.
SQ Magazine’s Takeaway
The 24-times gap between ShinyHunters’ unvalidated 9 million claim and the 369,200+ confirmed through state filings is the story, not the breach alone. Extortion groups inflate leak-site numbers because the figure is a ransom lever, not a disclosure obligation. Medtronic’s statement stops short of a company-wide total, leaving both figures mismatched, but state filings are the harder evidence until Medtronic discloses more.
Medtronic and Amazon’s One Medical Senior Health both landed on ShinyHunters’ target list within a short window, and both breaches hit administrative systems rather than clinical devices. Health records combine identity with medical history in one package, which gives extortion groups a reason to keep working through device makers and health systems even when the devices themselves stay untouched.
