In the third week of July 2026, Abbott Laboratories confirmed it was investigating two separate cyber incidents that appear to be unrelated to one another and to have been carried out by different threat actors.
The first involves Exact Sciences, Abbott’s cancer diagnostics business. Abbott confirmed unauthorized access to internal legacy Exact Sciences systems after the extortion group ShinyHunters added the company to its data leak site, initially threatening publication after 18 July and later extending the deadline to 21 July. The group claims to have exfiltrated 30 million rows of customer data, including names, contact information, dates of birth, and approximately one million Social Security numbers. The reported entry vector: vishing attacks against Abbott employees in mid-June 2026, which yielded a compromised Microsoft Entra single sign-on account that provided access to certain internal systems.
The second concerns Abbott’s LabCentral portal. A different threat actor claims to have gained access on 4 July 2026 and to have slowly exfiltrated files by targeting API endpoints.
Abbott has stated that the incidents have not affected other business units, product availability, manufacturing, or patient services, and that it activated incident response procedures, engaged third-party cybersecurity experts, and notified law enforcement upon discovery. Class action investigations were announced within days.
Three distinct compliance failures are visible in this pair of incidents, and each one is generalisable.
Failure one: the identity perimeter is a phone call
The Exact Sciences intrusion did not begin with a vulnerability. It began with a conversation.
Vishing — voice phishing — against help desks and employees has been the signature technique of ShinyHunters and adjacent groups throughout 2025 and 2026. ComplianceHub has now documented the same playbook against Medtronic, DentaQuest, Charter/Spectrum, Instructure Canvas, and the NAIC. The technique is not evolving. It does not need to.
The reason it keeps working is structural. Enterprise identity has consolidated onto single sign-on, which is correct security architecture — it centralises authentication, enables consistent policy, and eliminates password sprawl. But consolidation also means that the recovery path for an SSO account is the single highest-value target in the organisation. A help desk agent who can reset an Entra credential or enrol a new MFA factor holds, functionally, the keys to every application behind the identity provider.
The controls that defeat this are unglamorous and well understood:
Out-of-band verification for all credential and MFA-factor changes. Never verify a caller using information that appears in a breach corpus — employee ID, date of hire, manager’s name, and the last four digits of anything are all publicly obtainable at scale. Verification should use a channel the caller did not initiate: a callback to the number of record, an approval pushed to an already-enrolled device, or a manager attestation.
Phishing-resistant authenticators. FIDO2 security keys and platform passkeys are not vulnerable to real-time relay of a one-time code, because the credential is bound to the origin. Push-notification MFA and TOTP are.
A hard limit on what any single help desk role can do. MFA re-enrolment for a privileged account should require a second authoriser. This is the control that converts a successful social engineering call into a failed one.
Conditional access on the recovery path. Newly enrolled factors should trigger elevated monitoring and, for privileged accounts, a step-up review before broad access is granted.
Every one of these was available to Abbott. Every one of them is available to every reader of this article.
Failure two: “legacy systems” is a data governance category, not a technical one
Abbott’s own confirmation uses the phrase internal legacy Exact Sciences systems. That word is doing an enormous amount of work.
Exact Sciences was acquired by Abbott. Acquisition integration is the single most reliable generator of legacy data estates: systems that continue to run because they hold historical records, that no longer have an engaged product owner, that sit outside the acquirer’s standard monitoring and hardening baseline, and whose retention rules were inherited rather than designed.
The claimed data set — 30 million rows, one million Social Security numbers — is consistent with the accumulated history of a diagnostics business, not with its current operating requirements. A cancer diagnostics company needs current patient records to deliver current results. It does not need a decade of Social Security numbers in a live, network-reachable database.
This is a HIPAA Security Rule problem before it is an incident response problem. 45 CFR § 164.308(a)(1)(ii)(A) requires a risk analysis covering all ePHI the covered entity or business associate creates, receives, maintains, or transmits. “Maintains” includes the legacy system nobody has looked at since the acquisition closed. A risk analysis that scopes only to production systems in current use is, on its face, incomplete — and incomplete risk analysis is the most frequently cited finding in OCR enforcement actions.
The related obligations:
- § 164.310(d)(2)(i) requires policies for the disposal of media containing ePHI. Retention that exceeds documented business and legal need is a disposal failure.
- § 164.312(a)(2)(iv) addresses encryption of ePHI at rest as an addressable specification — meaning it must be implemented or the decision not to must be documented and justified. Legacy systems are precisely where that documentation does not exist.
- § 164.308(a)(1)(ii)(D) requires regular review of information system activity. A system with no assigned owner has no one reviewing its logs.
The proposed HIPAA Security Rule amendments we analysed in our coverage of the overhaul would tighten several of these from addressable to required. Organisations sitting on legacy clinical data estates have a narrowing window in which “we hadn’t got to it yet” remains an available answer.
The practical action: run an acquisition-triggered data inventory. For every entity acquired in the last five years, identify every system still holding personal or health data, name an owner, apply the current retention schedule, and either bring the system into the standard monitoring baseline or decommission it. The systems that fail this exercise are the ones that will appear in your next breach notification.
Failure three: API exfiltration that looked like normal traffic
The LabCentral incident is described as slow exfiltration via API endpoints, beginning 4 July.
Slow is the operative word. Bulk data theft through an application’s own API, paced to stay under rate limits and volume thresholds, does not resemble an attack in any log a human reads. It resembles an integration. It produces authenticated requests to legitimate endpoints, returning correctly formatted responses, from a client that is behaving within the documented contract of the API.
Detecting it requires controls most organisations have not implemented:
Behavioural baselining per credential. The relevant question is not “is this request authorised” but “does this consumer normally retrieve this volume, this breadth of records, at this hour, from this network location.” A service account that has historically pulled 500 records a day and begins pulling 5,000 is anomalous even if every individual request is permitted.
Cumulative volume limits, not just rate limits. Rate limiting caps requests per second. It does nothing about a client making permitted requests continuously for three weeks. Per-credential daily and monthly record ceilings, with alerting on approach, close that gap.
Object-level authorisation enforced server-side. Broken object-level authorisation remains the top entry in the OWASP API Security Top 10 for a reason. An endpoint that returns record id=12345 to any authenticated caller, without checking that the caller is entitled to that specific record, is an enumeration engine.
An inventory of API endpoints that includes the undocumented ones. Portals accumulate endpoints created for a specific feature, a mobile client, or a partner integration, which then remain reachable long after the consumer is retired.
The extortion dynamic and the disclosure clock
ShinyHunters set a deadline, then extended it. This is standard practice and it is designed to compress the victim’s decision-making. It should not compress the victim’s disclosure timeline.
For a company in Abbott’s position, the obligations run in parallel and do not wait for negotiation to conclude:
- HIPAA Breach Notification Rule (45 CFR §§ 164.400–414): notification to affected individuals without unreasonable delay and no later than 60 days from discovery; HHS notification within 60 days for breaches affecting 500 or more individuals; media notification for breaches affecting more than 500 residents of a state or jurisdiction.
- SEC Item 1.05 Form 8-K: within four business days of determining materiality. Abbott is a public company, and the determination is a board-level judgment about a business unit’s data, not a technical judgment about record counts.
- State breach notification statutes: all 50 states, with varying timelines and content requirements, triggered by the Social Security numbers claimed.
- State AG notification thresholds, several of which are lower than the federal ones.
A useful discipline: the incident response plan should state explicitly that regulatory clocks run independently of extortion negotiation, and should name the individual with authority to start notification drafting before the negotiation concludes. Organisations that couple the two consistently notify late.
What to take from a dual-incident month
Two unrelated actors reached two different parts of the same company within weeks. That is not coincidence and it is not bad luck — it is what a large, acquisitive, data-rich healthcare organisation looks like to the current threat market. The remediation is not a single control. It is three:
- Harden the identity recovery path until a phone call cannot produce a working credential.
- Find the data you forgot you had, particularly in acquired estates, and either govern it or delete it.
- Instrument your APIs for volume and behaviour, not just for authentication and rate.
Abbott’s response — third-party forensics, law enforcement notification, containment confirmation across business units — is competent post-incident practice. The costs it now faces were determined months earlier, by decisions about help desk procedure, acquisition data retention, and API telemetry that nobody experienced as security decisions at the time.
This article is provided for informational purposes only and does not constitute legal advice.
