Medtronic Confirms Hack After ShinyHunters Claims Data Theft
Summary
Medtronic confirmed its systems were hacked but has not confirmed data theft. ShinyHunters claimed to have stolen millions of records; Medtronic reported no impact to products, patient safety, or operations and is investigating possible access to personal information.
Key points
- Medtronic confirmed that its systems were hacked and said it is investigating whether personal information was accessed; it has not confirmed data theft.
- ShinyHunters claimed it compromised more than 9 million records containing personal information and terabytes of corporate information.
- The group reportedly gave Medtronic until April 21 to pay a ransom, threatening to leak the data.
- Medtronic reported no identified impact to products, patient safety, customer connections, manufacturing, distribution, financial reporting, or its ability to meet patient needs.
- Medtronic said its corporate IT, product, and manufacturing networks are separate; hospital customer networks are separately managed by customers’ IT teams.
- Medtronic’s diabetes-focused subsidiary MiniMed reported to the SEC that its own IT systems were not affected.
- Medtronic was later removed from ShinyHunters’ leak site; the article says this may indicate a ransom payment, but no payment was confirmed.
Article Details
- Victim Organization
- Medtronic
- Incident Type
- System compromise; ShinyHunters claimed data theft and threatened to leak the data unless a ransom was paid.
- Data Types Exposed
- Personal information (claimed by ShinyHunters; theft not confirmed by Medtronic)
- Corporate information (claimed by ShinyHunters)
- Affected Records
- ShinyHunters claimed to have compromised more than 9 million records; Medtronic has not confirmed data theft.
- Affected Data Size
- ShinyHunters claimed the records were accompanied by terabytes of corporate information; this has not been confirmed by Medtronic.
- Operational Impact
- Medtronic said it had not identified an impact to its products, patient safety, customer connections, manufacturing or distribution operations, financial reporting systems, or ability to meet patient needs. MiniMed reported that its IT systems were not affected.
- Ransom Or Extortion
- ShinyHunters gave Medtronic until April 21 to pay a ransom and threatened to leak the allegedly stolen data. Medtronic was later removed from the group's leak website, which the article says may indicate a ransom was paid; payment was not confirmed.
- Claim Status
- confirmed