MEDTRONIC has disclosed a data breach that exposed the personal and medical information of approximately 3.8 million individuals.
The incident, traced to the hacking group ShinyHunters, was identified in April 2026 after unauthorised access to a corporate system was detected.
The compromised data includes names, mailing addresses, dates of birth, Social Security numbers and limited health information such as treatment dates and diagnosis codes.
Medtronic confirmed that its clinical devices and hospital networks remained operational and that patient safety was not affected.
ShinyHunters is known for large‑scale data thefts and extortion attempts, often selling stolen datasets on underground forums.
In this case the attackers reportedly accessed over nine million records, though Medtronic has not found any evidence that the stolen information has been published or misused.
Since discovering the breach Medtronic has begun notifying affected individuals and is offering twenty‑four months of free credit monitoring and identity‑theft protection.
The company states that it has implemented additional security measures and is working with law enforcement to investigate the intrusion.
Individuals who receive a notice should review their financial statements for unfamiliar transactions and consider placing a fraud alert or credit freeze with the major credit bureaus.
They should also be wary of unsolicited emails or phone calls that request personal details, as attackers may use the harvested data for phishing.
Organisations holding sensitive data are advised to enforce multi‑factor authentication on all privileged accounts, to segment networks so that breach containment is easier, and to encrypt data at rest and in transit.
Regular penetration testing and tabletop incident‑response exercises can help detect gaps before they are exploited.
Finally, maintaining an up‑to‑date inventory of assets and applying security patches promptly reduces the attack surface that groups like ShinyHunters target.