Medical technology giant Medtronic is notifying more than 3.8 million individuals that their personal and medical information was compromised in a recent data breach.
The incident occurred in April 2026, when the infamous extortion group ShinyHunters accessed the company’s corporate IT systems.
Medtronic confirmed the attack in late April, noting that its products and manufacturing and distribution operations were not affected.
ShinyHunters had added the company to its Tor-based leak site on April 17, claiming the theft of over 9 million records of personal information, and terabytes of corporate data.
The group has since removed Medtronic from the website, which suggests that the company might have paid a ransom to recover the stolen information.
This week, the medical technology titan started sending written notification letters to the affected individuals, confirming that the hackers stole patients’ personal and medical information, including names, contact details, dates of birth, Social Security numbers, and health-related details.
“We have no evidence that any of that information was posted publicly or exposed on the internet,” reads a copy of the company’s notification letter (PDF) submitted to the California Attorney General’s Office.
Medtronic told the Indiana Attorney General’s Office that 3,834,294 individuals were affected by the incident.
The company is providing them with 24 months of free credit monitoring, dark web monitoring, and identity theft restoration services.
“Medtronic has implemented additional safeguards and continues to work with third-party cybersecurity experts to identify opportunities to further strengthen the security of its systems. Medtronic has also worked with law enforcement and is notifying relevant regulatory authorities,” the company said.
Related: Aflac Japan Data Breach Impacts 4.38 Million
Related: Nissan Employee Data Breached in Oracle PeopleSoft Hack
Related: More Klue Breach Victims Identified as Hackers Get Hacked
