Medtronic suffered a data breach in April 2026 when the ShinyHunters extortion group accessed its corporate IT systems and stole over 9 million records, including personal and medical information of about 3.8 million individuals. The attackers posted the data on a Tor-based leak site but removed it shortly after, suggesting a potential ransom payment. Medtronic confirmed that its core product and manufacturing operations were not impacted. The company is notifying affected individuals, providing credit monitoring and identity theft restoration services, and collaborating with law enforcement and cybersecurity experts to enhance system security.

The breach exposed sensitive personal and medical information of approximately 3.8 million individuals, including names, contact details, dates of birth, Social Security numbers, and health-related data. This exposure increases the risk of identity theft and privacy violations for the affected individuals. Medtronic's operational capabilities related to products and manufacturing were not impacted. There is no evidence that the stolen information was publicly posted or further exposed on the internet after removal from the leak site.

Medtronic has initiated notification to affected individuals and is providing 24 months of free credit monitoring, dark web monitoring, and identity theft restoration services. The company has implemented additional safeguards and is working with third-party cybersecurity experts to strengthen its systems. Medtronic is also cooperating with law enforcement and relevant regulatory authorities. No further immediate action is required from affected individuals beyond utilizing the offered protective services.