Abbott Laboratories has confirmed that attackers gained unauthorized access to internal legacy systems belonging to Exact Sciences, the cancer screening company it acquired in late 2025 and now operates as its Cancer Diagnostics business. The confirmation, issued July 16, 2026, came only after the ShinyHunters extortion crew added Abbott to its data leak site and set a countdown.

What the gang says it took is enormous: more than 30 million rows of customer personal data — names, email addresses, phone numbers, physical addresses, dates of birth — and over 1 million Social Security numbers. On top of that, ShinyHunters claims more than 22 million client notes containing doctor-patient conversations, over 20 million medical orders, and a pile of internal contracts and NDAs.

Abbott’s public position is narrow and carefully worded. The intrusion touched “a limited number of internal systems” in Cancer Diagnostics, and the company said it “does not impact any business operations, product or product availability, manufacturing or lab operations, or our ability to serve patients.” Abbott added that it does not anticipate a material impact on its business or financial results.

Notice what that statement does not say. It does not say patient data is safe.

One Phone Call, One SSO Account

The entry point is the part every security team should be reading twice. According to reporting on the incident, the attackers ran voice phishing attacks against Abbott employees in mid-June 2026 and succeeded in compromising a Microsoft Entra single sign-on account. From that one federated identity, they reached the legacy Exact Sciences environment and began pulling data out.

This is not novel. It is ShinyHunters’ entire business model, executed for the eleventh or twelfth time this year against a Fortune 100-scale target. The group’s 2026 campaign has been a near-mechanical repetition of the same three steps: call a human, get a credential or an OAuth approval, walk out with a database. We documented the pattern at Cushman & Wakefield, across the wider Salesforce vishing campaign, at Charter/Spectrum, and in healthcare at DentaQuest and Medtronic.

The technical countermeasures for this attack have existed for years — phishing-resistant FIDO2 authenticators, conditional access policies that bind sessions to managed devices, help-desk verification that does not accept a confident voice as proof of identity. What keeps failing is not the technology. It is the assumption that a person on the phone is who they say they are.

Why Legacy Acquisition Infrastructure Is the Soft Target

Abbott closed its acquisition of Exact Sciences in late 2025. The breached systems are described as legacy Exact Sciences infrastructure — which is to say, an environment that had been operating under one company’s security program, was mid-way through absorption into another’s, and in the interim belonged fully to neither.

That gap is where breaches live. Post-acquisition integration typically takes 18 to 36 months for an organization the size of Abbott. During that window the acquired company’s identity provider, legacy databases, and data retention practices frequently sit outside the parent’s mature controls: not in the SIEM, not in the privileged access management rollout, not in the conditional access policy, still holding a decade of records nobody has been assigned to delete.

Exact Sciences is a molecular diagnostics company based in Madison, Wisconsin, best known for Cologuard colorectal cancer screening and the Oncotype DX breast cancer test. Its records are not marketing lists. They are cancer screening histories — which patient was tested, when, and for what. The claimed 22 million “client notes containing doctor-patient conversations” is, if accurate, one of the most sensitive corpora any extortion group has held this year.

The Deadline Came and Went

ShinyHunters initially threatened to publish after July 18, then extended to July 21. As of July 20, nothing had been leaked. Both deadlines have now passed with no publication and no confirmation from Abbott that a payment was made.

Extended deadlines usually mean one of two things: the victim is negotiating, or the gang is bluffing about the value of what it holds and hoping for a nibble. ShinyHunters has form for both. When Instructure paid earlier this year, the data stayed offline; when victims refused, listings have generally gone live within weeks.

It is also worth stating plainly what has and has not been verified. The 30 million figure is ShinyHunters’ claim, not a confirmed count. No researcher has independently validated the volume, and no sample of the alleged data has been published. Extortion groups routinely inflate. But the group’s claims have proven broadly accurate more often than not across its 2026 campaign, and Abbott’s confirmation of an intrusion — however narrowly scoped — removes the possibility that the listing was fabricated entirely.

What Happens Next

If the claims hold, this becomes one of the largest US healthcare data incidents of 2026, in the tier occupied by the Conduent breach. That triggers HIPAA breach notification obligations to HHS’s Office for Civil Rights within 60 days of discovery, state attorney general notifications, and — inevitably — litigation. The first suits have already been filed.

Abbott has not issued individual notifications. Until it does, roughly 30 million people have no way of knowing whether their cancer screening records are sitting in a criminal group’s storage, waiting on a negotiation they will never be told the outcome of.

Sources