Skip to content
Breach Index · running record

Medtronic data breach (2026): 3.8 million people and what Medtronic confirmed

In mid-2026 Medtronic began notifying millions of people that attackers had reached some of its corporate IT systems in April. Medtronic publicly holds ISO 27001 for its CareLink network, a different system.

Short answer

Was Medtronic hacked?

Yes. Medtronic told regulators attackers had access to some corporate IT systems between 13 and 19 April 2026, and that names, contact details, dates of birth, Social Security numbers and health information may have been taken. Its Indiana Attorney General filing lists 3,834,294 people.

ShinyHunters claimed the attack and more than 9 million records. Medtronic says products, patient safety and manufacturing were not affected.

Timeline at a glance

  1. 13–19 Apr 2026Attackers have access to some corporate IT systems. (SecurityWeek)Confirmed
  2. Jul 2026Indiana AG filing: 3,834,294 people. (SecurityWeek)Confirmed
  3. 2026ShinyHunters claims 9M+ records. (HIPAA Journal)Unverified claim

Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Medtronic’s security posture at the time

What Medtronic publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.

Security certifications publicly held

Scope vs breach. The published certificate scope covers a different part of the business from the system that was breached. The published ISO 27001 scope is the CareLink network; the breach was in corporate IT systems.

Size

Revenue $33.5 billion, FY2025 (year ended 25 Apr 2025). Medtronic Q4 FY2025 results (8-K)

Listing: NYSE: MDT

Share price around the disclosure

No reliable report of a share-price move around the disclosure was found.

Medtronic incident timeline, in detail

Confirmed = acknowledged by Medtronic, a regulator filing or a court. Reported = credible reporting Medtronic has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Jul 2026 (access 13–19 Apr)ConfirmedIdentity / corporate IT

Corporate IT access exposes data on 3.8 million people

What happened. Medtronic told regulators that attackers had access to some corporate IT systems between 13 and 19 April 2026, and that names, contact details, dates of birth, Social Security numbers and health information may have been taken. ShinyHunters claimed the attack and more than 9 million records.

Impact. Social Security numbers and health information may have been taken; 24 months of credit monitoring offered. People or records affected: 3,834,294 people, per Medtronic’s filing with the Indiana Attorney General (reported by SecurityWeek).

Sources: SecurityWeek — Medtronic breach impacts 3.8 million · HIPAA Journal — Medtronic

The pattern across the record

Certified, and still breached?

Medtronic publicly held ISO 27001. Stated scope: The Medtronic CareLink network (remote monitoring), per Medtronic. CareLink network, Spain. The published scope covers a different part of the business from the system that was breached.

The way in was a person, not a server

Like most of 2026’s large data thefts, this one is described as starting with social engineering: a phished or voice-phished login, often to single sign-on, then bulk export from a SaaS application. Certification audits test that identity controls exist and operate; they do not promise that no employee or contractor will ever be talked out of a login.

What it means for Medtronic patients, clinicians and partners of Medtronic — and what to do

What Medtronic’s customers, partners and security teams can do now, based only on what has been disclosed.

  1. 1.Assume phishing follows the breach

    Exposed contact details are used for convincing follow-up phishing. Warn staff and customers that genuine notices will not ask for passwords or payment.

  2. 2.Check your own help-desk and SSO flows

    Require callback verification and phishing-resistant MFA for account and MFA resets; voice requests alone should never reset a login.

  3. 3.Ask the vendor what was exported, in writing

    Ask which applications and fields were reached, the date range, and whether your organisation’s records were included.

    Open the Third-Party Breach Intake

CISO takeaways

Read the scope, not the badge

Ask for the SOC 2 system description or ISO 27001 statement of applicability, and check the system you care about is in it.

Score a vendor
Price the risk you still carry

Certification does not transfer liability. Model what an incident would cost and whether insurance covers it.

Open the cyber insurance tool
Rehearse the vendor call

Most 2026 incidents reached customers through a supplier. Practise the first questions you would ask.

Open the Vendor Breach Lab
Know your clock

Work out which notification deadlines apply before you need them.

Open the notification clock

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed October 31, 2026.

  1. 1.SecurityWeek — Medtronic breach impacts 3.8 million — SecurityWeek, reviewed 31 Oct 2026
  2. 2.HIPAA Journal — Medtronic — hipaajournal.com, reviewed 31 Oct 2026
  3. 3.Medtronic — CareLink network — medtronic.com, reviewed 31 Oct 2026
  4. 4.Medtronic Spain — ENS certification — medtronic.com, reviewed 31 Oct 2026
  5. 5.Medtronic Q4 FY2025 results (8-K) — SEC EDGAR, reviewed 31 Oct 2026

Frequently asked questions

Was Medtronic hacked?

Yes. Medtronic told regulators attackers had access to some corporate IT systems between 13 and 19 April 2026, and that names, contact details, dates of birth, Social Security numbers and health information may have been taken. Its Indiana Attorney General filing lists 3,834,294 people.

Did Medtronic have SOC 2 or ISO 27001 certification?

Medtronic publicly held ISO 27001. Stated scope: The Medtronic CareLink network (remote monitoring), per Medtronic. CareLink network, Spain. The published scope covers a different part of the business from the system that was breached.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Stryker data breachHealthcare and life sciences

A global Microsoft-environment outage and a wiper claim.

iRhythm Technologies data breachHealthcare and life sciences

Third-party-hosted apps and an 8-K.

Novo Nordisk data breachHealthcare and life sciences

Pseudonymised trial data and a $25M claim.

McKesson data breachHealthcare and life sciences

An 8-K and a 284M-record claim.

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Medtronic. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.

🎉 New here? Use code WELCOME10 for 10% off any plan at checkout