ShinyHunters called cancer diagnostics biz and tricked staffers into giving them access. Now they've dumped 10.9M email addresses

Hackers masquerading as Abbott employees successfully tricked internal staff into divulging sensitive information via a phishing scam, resulting in a massive data breach. The compromised data, now publicly available, comprises approximately 10.9 million distinct email addresses, alongside personal and health details belonging to patients, healthcare providers, and company personnel.

Data aggregation firm Have I Been Pwned added the breach to its database on Friday, following the leak's publication on the dark web. Abbott disclosed the intrusion on July 16 and confirmed the theft on August 5, acknowledging that some files contained personal and/or health information. The company stated that only a limited number of internal systems were affected, with no disruption to products, manufacturing, or patient services.

ShinyHunters, the cybercriminal group responsible for the breach, claimed to have acquired over 30 million records, including more than a million Social Security numbers and 7.5 million dates of birth. Additionally, they reportedly obtained 22 million confidential doctor-patient conversations, 20 million medical-order records, and 425 million rows from Databricks, 130,000 files from SharePoint, and 89,000 contracts from Coupa.

While Abbott has not disclosed the details of the vishing attack or the duration of the intruders' access, the company remains committed to notifying affected individuals as required.