In April 2026, Medtronic detected unauthorized access to its corporate IT systems resulting in the exposure of sensitive personal data of about 9 million records. The ShinyHunters data extortion group claimed responsibility and threatened to release the data publicly if a ransom was not paid, though the threat was later withdrawn. The compromised data includes personally identifiable information and health-related details. Medtronic engaged third-party cybersecurity experts to investigate and has assured customers that its medical devices remain secure and unaffected by the breach.

The breach exposed sensitive personal information including full names, contact information, dates of birth, Social Security numbers, and health-related data of millions of individuals. This exposure increases the risk of identity theft, social engineering, phishing attacks, and other scams targeting affected individuals. There is no indication that Medtronic's medical devices or operational systems were compromised or affected by this incident.

Medtronic is notifying affected customers and offering 24-month credit monitoring and identity theft protection services to mitigate risks associated with the data exposure. Customers are advised to remain vigilant for suspicious communications that may leverage the stolen data for scams or phishing attempts and to monitor their accounts closely. No patch or fix is applicable as this is a data breach incident involving unauthorized access rather than a software vulnerability.