Abbott Cancer Diagnostics disclosed on July 16 that it had suffered a cyber intrusion that resulted in the theft of personal and health information linked to 10.9 million unique email addresses. The company updated its statement on August 5, saying that some of the accessed files contained personal information and personal health information, and that it was still assessing which individuals required notification. The breach began with a vishing attack and involved limited internal systems within the cancer diagnostics unit, Abbott said, and did not disrupt its products, manufacturing, laboratory operations, or patient services.

Security researcher Have I Been Pwned added the incident to its database after data posted by the extortion group ShinyHunters was made public. ShinyHunters claimed to have obtained more than 30 million rows of customer information, including over one million Social Security numbers, 7.5 million dates of birth, and more than 22 million rows of client notes containing doctor‑patient conversations and health details, as well as more than 20 million medical‑order records with patient IDs, prescription types, and refill dates. The group also said it had accessed over 425 million rows of data from Databricks, 130,000 files from SharePoint, and 89,000 contracts from Coupa, though those figures have not been independently verified.

Abbott has not disclosed how the vishing attack facilitated the theft, how long the intruders remained in its systems, or whether an extortion demand was made. The investigation is ongoing, and the company indicated that affected individuals will be notified as required.

The incident underscores the potential impact of social engineering attacks on healthcare data security and the challenges of timely breach notification.