Abbott is fighting off two hacking gangs at once

Healthcare and diagnostics giant Abbott Laboratories is investigating two separate intrusions running in parallel, which is an unusual enough situation that it is worth walking through carefully.

The extortion group ShinyHunters says it got in through a vishing call, a voice phishing attempt where an attacker rings a company help desk or employee and talks their way past identity checks. The gang claims it used this to hijack a Microsoft Entra single sign-on account belonging to an Abbott employee in mid-June, then used that access to reach legacy systems tied to Abbott's Exact Sciences cancer diagnostics business.

ShinyHunters says the haul includes more than 22 million client notes, over 20 million medical orders, internal contracts, customer agreements, and more than 1 million Social Security numbers. It set a leak deadline of 18 July, then pushed it to 21 July, a shift that usually signals ransom negotiations are underway. A second, separate group calling itself ShadowByt3$ is independently claiming access to a different Abbott portal.

As of writing, neither group has published the data they claim to hold. Abbott has confirmed unauthorised access to a limited number of legacy Exact Sciences systems in its Cancer Diagnostics business, disputes the portal claim, and has not confirmed the scale of either.

What is actually claimed, and what is not

Everything above comes from the attackers. Extortion crews have an obvious incentive to inflate their numbers, because a bigger headline puts more pressure on the victim. Until Abbott confirms what was accessed, or sample data is independently verified, treat every figure as an allegation.

That caution cuts both ways. Gangs also sometimes undersell a breach to keep negotiations quiet. The honest position is that nobody outside the investigation knows the true size yet.

The two claims side by side

Two groups making separate claims does not prove the same hole was used twice. Nothing so far links them.

How a phone call beats a security stack

Vishing is social engineering by voice. The caller poses as an employee who has lost a phone or locked themselves out, and leans on the help desk to reset a password or enrol a new device for multi-factor authentication. Help-desk staff are trained to be helpful, and that is the weakness. For a deeper look at how these calls work, see our explainer on what vishing is and how to prevent it.

It works because the technology is rarely the target. Voice adds pressure that email cannot: urgency, a confident tone and a real person waiting on the line.

Why single sign-on raises the stakes

Single sign-on (SSO) lets one login unlock dozens of applications. That is convenient and, done properly, safer than a pile of reused passwords. But it concentrates risk. Take over one identity in a platform such as Microsoft Entra and an attacker may inherit everything that identity can reach.

If the claim is accurate, the mid-June account hijack would have been the single key that opened the legacy systems. Legacy systems are a familiar problem. They tend to sit behind older access rules, get patched less often and hold data that nobody remembered to migrate or retire.

Where help-desk verification fails

Most help-desk scripts rely on knowledge-based checks: employee number, date of birth, manager's name. Much of that is easy to find or buy. Attackers often gather it from social media, past leaks and professional networking profiles before they ever dial.

Stronger options are not exotic:

• Call back on a number already held in the HR system, never one the caller supplies.
• Require approval from the employee's line manager through a separate channel.
• Use an in-person or video check for any request to reset multi-factor authentication.
• Delay and flag changes to security factors on accounts with broad access.
• Give help-desk staff explicit permission to refuse, with no penalty for slowing down.

The cost of getting it wrong

Healthcare data is among the most valuable to criminals. Medical records last longer than a card number, which can be cancelled in minutes. A diagnosis or a Social Security number cannot.

For an organisation holding millions of patient records, even a partial leak triggers notification duties, regulator attention and potential litigation. That is why pressure tactics such as deadlines work, and why a deadline extension tends to be read as negotiation.

A familiar pattern

ShinyHunters is not new to this. The group has been tied to a run of high-profile claims, including the reported One Medical breach claim and a campaign linked to a single flaw in Oracle PeopleSoft. Sensitive financial records have surfaced elsewhere too, as with the EY tax data breach.

The common thread is that attackers go where identity and data meet. They would rather log in than break in.

What organisations can do this week

Start with the cheapest fix: audit how your help desk handles MFA resets and write the process down. Then test it. A friendly internal red-team call costs very little and shows quickly whether staff fold under pressure.

Next, prefer phishing-resistant authentication such as hardware security keys or passkeys for administrators and anyone with access to sensitive records. Codes sent by text or approved with a tap can be talked out of a victim, while a physical key cannot.

Finally, review which legacy systems still hold live patient or customer data, and whether they really need to sit behind the same sign-on as everything else. Segmenting them limits what one stolen identity can reach.

Why this matters

The headline number is eye-catching, but the real story is the method. A phone call was reportedly enough to get past the defences of a company with the resources to run a serious security programme. If your organisation's help desk can be talked into resetting multi-factor authentication over the phone without stronger verification, this is the week to fix that, not after it happens to you.

If you've had contact with Abbott's diagnostics or cancer testing services, there's nothing actionable yet since no data has surfaced. Keep an eye on official Abbott communications rather than reacting to the extortion group's claims, which are, by definition, unverified.

Key takeaways

• ShinyHunters claims a vishing call hijacked an Abbott employee's Microsoft Entra single sign-on account in mid-June. This is unverified.
• The group claims more than 22 million client notes, over 20 million medical orders and more than 1 million Social Security numbers. Abbott has not confirmed the scale of any of it.
• The leak deadline moved from 18 July to 21 July, which often points to ransom talks. Neither group has published data.
• A second group, ShadowByt3$, separately claims access to a different Abbott portal, with no proven link to the first.
• Help desks are the weak point: verify callers through a separate channel and treat MFA resets as high-risk.
• Single sign-on concentrates risk, so protect privileged identities hardest and retire legacy systems.
• Patients should wait for official Abbott communications rather than act on the attackers' claims.