--- title: "Medtronic Data Breach: 3.8M Notified, What to Do" url: https://playciso.com/blog/medtronic-data-breach-2026 updated: 2026-11-09 section: Blog publisher: PlayCISO --- # Medtronic Data Breach: 3.8M Notified, What to Do > Medtronic says an unauthorized party accessed corporate IT systems in April 2026. 3,834,294 notified; ShinyHunters claimed 9M. Confirmed vs claimed. Source: https://playciso.com/blog/medtronic-data-breach-2026 · Published: 2026-11-09 · Publisher: PlayCISO (https://playciso.com) Primary source: https://www.sec.gov/Archives/edgar/data/0001613103/000162828026027272/mdt-20260424.htm --- Medtronic, the medical device maker, told the SEC on 24 April 2026 that an unauthorized third party had accessed data in certain of its corporate IT systems. Notices it later filed with state attorneys general, as reported by TechTarget and GovInfoSecurity, put the access at 13 to 19 April 2026. SecurityWeek reports that Medtronic told the Indiana Attorney General that **3,834,294 people** were affected, with notification letters going out from late June 2026. The extortion group ShinyHunters listed Medtronic on its leak site and *claimed* more than 9 million records; Medtronic has not validated that figure. Medtronic says it has not identified any impact to its products or patient safety. ## Confirmed vs not yet known - Medtronic states (8-K, 24 April 2026): an unauthorized third party accessed data in certain of its information technology systems; it "promptly took steps to contain the incident"; it "has not identified any impact to its products, patient safety"; and it "does not currently expect the incident to have a material impact on its business or financial results." - Medtronic states in notices (as reported): access ran 13 to 19 April 2026; the data may include names, contact information, dates of birth, Social Security numbers and health-related information; it has "no evidence" the information was posted publicly. - Reported from state filings: 3,834,294 people in total (Indiana per SecurityWeek, Oregon per HIPAA Journal). By state, as reported by HIPAA Journal: Texas 297,307, Massachusetts 63,534, Vermont 8,668. - Claimed, not verified: ShinyHunters says it took more than 9 million records and terabytes of internal data. Medtronic has not validated the number, and its 8-K does not name an attacker. - Not confirmed: whether a ransom was paid. The leak-site listing was later removed; two outlets say that suggests payment is possible, and neither has confirmation. - Not in the sources we read: how the attackers got in, which systems or databases held the data, and a final count of people by data type. ## What Medtronic says it did In the 8-K, Medtronic says that on identifying the unauthorized access it took steps to contain the incident, activated its incident response protocols and engaged external cybersecurity experts. Outlets quoting the company's statement report that its corporate IT, product and manufacturing networks are separate and that hospital customer networks are managed by customers. In the notification, per SecurityWeek, it says it "has implemented additional safeguards and continues to work with third-party cybersecurity experts" and has worked with law enforcement. The figures to treat with care are the ones that come from the attackers, not the company. ## The numbers, and where sources differ | Figure | Who says it | Status | | --- | --- | --- | | 3,834,294 people | SecurityWeek (Indiana AG); HIPAA Journal (Oregon AG) | From state breach filings, as reported | | More than 9 million records | ShinyHunters, via its leak-site listing | Claim; not validated by Medtronic | | Texas 297,307; Massachusetts 63,534; Vermont 8,668 | HIPAA Journal | From state filings, as reported | | "Not disclosed" total | TechTarget and GovInfoSecurity, 30 June to 1 July | Written before the 3.8 million figure was reported | Early coverage gave only state counts. The 3.8 million total appeared in SecurityWeek on 3 July. A record count in an attacker's post and a count of notified people are different things, so do not read the 9 million as the number of victims. ## Timeline | Date (2026) | Event | Source | | --- | --- | --- | | 13 Apr | Start of the access window given in Medtronic's notices | TechTarget; GovInfoSecurity | | 15 Apr | Medtronic learned of suspicious activity in corporate IT systems | HIPAA Journal (not verified by us against the notice) | | 17 or 18 Apr | ShinyHunters lists Medtronic on its leak site. Outlets differ: 17 April (SecurityWeek, GovInfoSecurity) and 18 April (Security Affairs) | Attacker claim, as reported | | 19 Apr | End of the access window in Medtronic's notices | TechTarget; GovInfoSecurity | | 21 Apr | Ransom deadline set by ShinyHunters | Security Affairs; HIPAA Journal (attacker claim) | | 24 Apr | Medtronic files a Form 8-K and publishes a statement | SEC Form 8-K | | 30 Apr | first complaint (file named for Marquardt) filed; at least six proposed federal class actions in a Minnesota federal court by 1 May | GovInfoSecurity, 1 May | | Late Apr | ShinyHunters listing no longer visible | TechTarget; Security Affairs | | Week of 29 Jun | Written notification letters begin; filings appear with state attorneys general | SecurityWeek (3 Jul); GovInfoSecurity (30 Jun) | | 1-3 Jul | Coverage notes the incident was not yet on the HHS OCR breach portal; the 3,834,294 total is reported | TechTarget; HIPAA Journal; SecurityWeek | Medtronic is also covered in our [breach index entry](/breach-index/medtronic) and, briefly, in the [April 2026 recap](/blog/april-2026-cybersecurity-breaches-roundup). ## Lawsuits and regulators GovInfoSecurity reported on 1 May 2026 that Medtronic faced at least six proposed federal class actions in a Minnesota federal court, brought by patients of its cardiac devices and other products. One complaint, in a file named for Marquardt, is dated 30 April 2026. The suits allege negligence in protecting personal and health information and a "substantial increased risk of identity theft". Those are the plaintiffs' allegations, not findings. We did not check the dockets, so later consolidation, rulings or settlements are not covered here. On regulators, the 8-K is the SEC disclosure, and the breach was reported to state attorneys general including California, Indiana, Massachusetts, Oregon, Texas and Vermont according to the outlets above. In early July, TechTarget and HIPAA Journal said it had not yet appeared on the HHS Office for Civil Rights breach portal; we have not rechecked it. ## What affected people should do This follows what the notice reportedly offers and standard identity-protection practice. Read your own letter first, because it says which of your details were involved. - Enrol in the free protection. HIPAA Journal and others report 24 months of credit monitoring, dark web monitoring and identity theft restoration, plus healthcare insurance plan ID monitoring, Medicare beneficiary ID monitoring and identity theft reimbursement of up to $1 million. Use the enrolment instructions in your letter, not a link from an email or text. - Review your credit reports and consider a fraud alert or credit freeze, since Social Security numbers may be involved. - Read your health insurance explanations of benefits for care or equipment you did not receive. - Expect scams. Medtronic says it has no evidence the data was posted publicly, but criminals use news of a breach as a hook. Do not give details to anyone who contacts you first, even if they mention Medtronic. - Your device is a separate question. Medtronic says it has found no impact to product security or patient safety. Do not change any treatment or device setting because of this breach; speak to your care team if you have concerns. ## What security leaders should do this week - Treat corporate IT as in scope for clinical and product risk. The company says the networks were separate and the products unaffected. Check that your own segmentation would hold up to the same claim, with evidence. - Know your notification clocks. The gap between the access window in April and letters in late June is a reminder to map state, HIPAA, SEC and contract deadlines before you need them. - Prepare for a claim before you have the facts. An attacker listing arrived before the company statement. Decide who validates a claim, who talks to regulators and what you say while scope is unknown. - Separate "records" from "people". Attacker numbers and filed numbers differed by more than double. Agree how your team counts, and never repeat an attacker figure as fact. - Review vendors that hold your patients' or staff's data. Ask what they hold, how fast they notify you, and whether their incident language names corporate systems. - Plan for litigation early. Class actions were filed within days of the 8-K. Preserve logs, keep a dated decision record and brief counsel before notices go out. ## Put it to work - [Data Breach Response Checklist](/tools/data-breach-response-checklist): walk containment through to notification. - [Breach Notification Clock Calculator](/tools/breach-notification-clock-calculator): line up the deadlines that start when you discover an incident. - [HIPAA Risk Self-Check](/tools/hipaa-risk-self-check): test your safeguards for health information. - [Third-Party Breach Response Checklist](/tools/third-party-breach-response-checklist): what to do when a vendor tells you it was breached. - [Detection Lab](/tools/detection-lab): practise spotting data theft from corporate systems. ## FAQ ### Was Medtronic hacked? Medtronic says an unauthorized third party accessed data in certain of its corporate IT systems. It said so in a Form 8-K filed with the SEC on 24 April 2026. Notices filed with state attorneys general, as reported by TechTarget and GovInfoSecurity, give the access window as 13 to 19 April 2026. ### How many people were affected by the Medtronic data breach? SecurityWeek reports that Medtronic told the Indiana Attorney General that 3,834,294 people were affected, and HIPAA Journal gives the same figure from the Oregon Attorney General filing. ShinyHunters claimed more than 9 million records; Medtronic has not validated that figure, and a record count is not the same as a count of people. ### What data was exposed in the Medtronic breach? Per reporting on Medtronic's notices, the information that may have been involved includes names, contact information, dates of birth, Social Security numbers and health-related information. Which items applied varies by person, so check your own letter. ### Who is ShinyHunters and did they breach Medtronic? ShinyHunters is an extortion group that listed Medtronic on its leak site and claimed to hold more than 9 million records. That listing is the group's claim. Medtronic has not verified the group's figures, and Medtronic's own filing does not name an attacker. ### Were Medtronic devices or patient care affected? Medtronic says no. In its 8-K it says it "has not identified any impact to its products, patient safety" and the filing, as quoted by outlets, says its corporate IT, product and manufacturing networks are separate. The data at issue is personal information held in corporate systems, not device data. ### Is there a Medtronic data breach lawsuit? Yes, several. GovInfoSecurity reported on 1 May 2026 that Medtronic faced at least six proposed federal class actions in a Minnesota federal court, filed by plaintiffs including cardiac device patients, alleging negligence. These are allegations, not findings. We have not checked the court dockets for later developments. ### What should I do if I got a Medtronic breach letter? Use the free monitoring the letter offers (reported as 24 months of credit monitoring, dark web monitoring and identity theft restoration), review your credit reports, consider a credit freeze, check explanation-of-benefits statements for services you did not receive, and treat unexpected calls, texts and emails that mention Medtronic as possible scams. ### Did Medtronic pay a ransom? Not confirmed. ShinyHunters' listing was later removed from its leak site. SecurityWeek and HIPAA Journal say this suggests a ransom might have been paid, but both present that as inference, and Medtronic has not said so. ## Sources - [Medtronic plc, Form 8-K dated 24 April 2026 (SEC EDGAR)](https://www.sec.gov/Archives/edgar/data/0001613103/000162828026027272/mdt-20260424.htm), the primary source for the company's disclosure - [SecurityWeek: Medtronic Data Breach Impacts 3.8 Million People](https://www.securityweek.com/medtronic-data-breach-impacts-3-8-million-people/) (3 July 2026) - [HIPAA Journal: Medical device maker Medtronic data breach](https://www.hipaajournal.com/medical-device-maker-medtronic-data-breach/) (1 July 2026) - [TechTarget: Medtronic notifies impacted patients of data breach tied to April hack](https://www.techtarget.com/healthtechsecurity/news/366645324/Medtronic-notifies-impacted-patients-of-data-breach-tied-to-April-hack) (1 July 2026) - [GovInfoSecurity: Medtronic Notifying Patients Affected by Data Theft Hack](https://www.govinfosecurity.com/medtronic-notifying-patients-affected-by-data-theft-hack-a-32115) (30 June, updated 1 July 2026) - [GovInfoSecurity: Medtronic Already Facing Federal Lawsuits in Recent Hack](https://www.govinfosecurity.com/medtronic-already-facing-federal-lawsuits-in-recent-hack-a-31570) (1 May 2026) - [Security Affairs: Medtronic discloses security incident after ShinyHunters claimed theft of 9M+ records](https://securityaffairs.com/191391/cyber-crime/medtronic-discloses-security-incident-after-shinyhunters-claimed-theft-of-9m-records.html) (27 April 2026) *This article is educational guidance for security leaders and affected people, not legal advice. We did not review the state attorney general filings, the notification letter or court dockets directly; figures from them are as reported by the outlets named. Check Medtronic's own notice for the latest details.*