Medtronic
Disclosed Apr 27, 20265 months ago3,834,294 affectedConfirmed
Medtronic confirms breach after ShinyHunters claims 9 million records
Medtronic confirmed attackers accessed certain corporate IT systems between April 13 and 19, 2026 after ShinyHunters claimed 9 million records. In July it began notifying people whose names, birth dates, SSNs and health information were exposed; it said the data was not posted online.
What is known
| People affected | 3,834,294 (as reported by the organization) |
|---|---|
| Disclosed | Apr 27, 2026 |
| Discovered | Apr 15, 2026 |
| Happened | Apr 13, 2026 |
| Attack | Extortion |
| Data exposed | Names, Social Security numbers, Health, Emails, Phone numbers, Dates of birth, Addresses |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Medtronicoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Medtronicatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: Medtronicattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Medtronicjustice.oregon.gov · Official notice | Official notice |
| Medtronic confirms breach after hackers claim 9 million records theftbleepingcomputer.com · News | News |
| Medtronic notifies customers impacted by ShinyHunters data breachbleepingcomputer.com · News | News |
| Texas Attorney General data security breach report BR-0005149: Medtronicoag.my.site.com · Official notice | Official notice |
| Vermont Attorney General breach report: Medtronicago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2026 data breach report: Medtronicin.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Apr 27 | |
| Vermont AGresidents of VT | Jun 28 | 8,668 |
| California AGresidents of CA | Jun 29 | |
| Washington AGresidents of WA | Jun 29 | 64,035 |
| Delaware DOJresidents of DE | Jun 29 | 14,745 |
| Oregon DOJresidents of OR | Jun 29 | 3,834,294 |
| Indiana AGresidents of IN | Jun 29 | 90,889 |
| Texas AGresidents of TX | Jun 30 | 297,307 |
Other breaches at Medtronic
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Nov 21, 2018Nov 21, 20187 years ago | Nov 21, 20187 years ago | Not stated | Tech | Confirmed | Unknown |
| Disclosed Jul 10, 2013Jul 10, 201313 years agoLost or stolen device | Jul 10, 201313 years ago | Lost or stolen device | Healthcare | Confirmed | 2,764 |
History of this record
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-7_2026.pdf · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/categories/security-breach-notices · backfill source
- 2026-09-25 · data_types: ["names","ssn","health","emails","phone","dob"] to ["names","ssn","health","emails","phone","dob","addresses"] · backfill source
- 2026-09-25 · sector: tech to health · seed source
- 2026-09-25 · attack: hacking to extortion · seed source
- 2026-09-25 · data_types: ["names","ssn","health"] to ["names","ssn","health","emails","phone","dob"] · seed source
- 2026-09-25 · disclosed: 2026-06-29 to 2026-04-27 · seed source
- 2026-09-25 · summary: empty to Medtronic confirmed attackers accessed certain corporate IT systems between April 13 and 19, 2026 after ShinyHunters claimed 9 million records. In July it began notifying people whose names, birth dates, SSNs and health information were exp · seed source
- 2026-09-25 · title: empty to Medtronic confirms breach after ShinyHunters claims 9 million records · seed source
- 2026-09-25 · data_types: [] to ["names","ssn","health"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 3834294 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2026-04-15 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.