ShinyHunters Dump 10.9 Million Emails From Abbott's Cancer Diagnostics Unit

Hackers have dumped data stolen from Abbott's cancer diagnostics business after the healthcare giant apparently declined to pay up, with the leak containing 10.9 million unique email addresses alongside personal and health information, The Register reported on August 7. The stolen data includes names, email and physical addresses, phone numbers, dates of birth, genders and personal health information belonging to customers, patients and healthcare providers. Have I Been Pwned added the Exact Sciences breach to its database on Friday.

A Vishing-Firsted Break-In

Abbott, which acquired cancer diagnostics outfit Exact Sciences earlier this year, first disclosed the break-in on July 16. In an update on August 5, it acknowledged that some of the files accessed contained personal information and/or personal health information, but said it was still analyzing the data and had yet to determine who needed to be notified. The company revealed that the intrusion began with a vishing attack, stressed that this was not an encryption malware event, and said only a limited number of internal systems within its cancer diagnostics business were affected, with no disruption to products, manufacturing, laboratory operations or patient services.

The Extortion Crew's Claims

ShinyHunters, on its dark web leak site, told Abbott it should have paid the ransom and claimed the company had failed to reach an agreement despite being given multiple chances. The crew claims it made off with more than 30 million rows of customer information, including more than one million Social Security numbers and 7.5 million dates of birth, plus more than 22 million rows of client notes and more than 20 million medical-order records — figures that have not been independently verified. Abbott has not said how the vishing attack led to the theft, how long the intruders had access, or whether it received an extortion demand; its investigation remains ongoing.