Central Intelligence
Central Intelligence®PERSPECTIVE IS EVERYTHING
Last Update: 10/27/2026 at 6:00 AM EST

ShinyHunters Healthcare Breaches

Coverage from BleepingComputer, Have I Been Pwned, and others

ShinyHunters Healthcare Breaches topic image

This subject brings together healthcare-sector data breaches, alleged data thefts, and leak threats attributed to ShinyHunters.

Reported incidents involve organizations including One Medical, McKesson, Baxter International, DentaQuest, and AdaptHealth, with claims concerning patient records, health information, and personal identifiers. Some accounts describe access involving third-party applications, cloud platforms, or archived file systems, while affected organizations have disclosed investigations or unauthorized access. Attribution and the scope of stolen data are not consistently independently confirmed, so allegations should be distinguished from organizations’ confirmed disclosures.

Looking Back
135 Day Timeline
Apr 16May 14Jun 11Jun 25Jul 23Aug 20
History
10/03/2026

The update makes company-side evidence more explicit: some organizations confirmed unauthorized access or exposed data, though the scale and contents of several alleged thefts remain unverified.

All Articles11 articles
Important2 articles · CI Score 60 and above
BleepingComputer / Lawrence Abrams
Health-ISAC Warns Of ShinyHunters Healthcare Data Theft
Health-ISAC warned healthcare and medical technology organizations on July 24 about ShinyHunters attacks using voice phishing and compromised SSO accounts to steal data from connected cloud services.
7/29/2026 • Cybersecurity (Privacy-Relevant) • General
BleepingComputer / Sergiu Gatlan
McGraw Hill Breach Exposes Data From 13.5 Million Accounts
ShinyHunters claimed a Salesforce misconfiguration led to theft of 13.5 million McGraw Hill accounts, exposing PII for potential spear-phishing and extortion threats.
4/16/2026 • Data Breaches & Exposure Events • General
Interesting9 articles · CI Score 45–59
Have I Been Pwned
Exact Sciences Breach Exposes 10.9 Million Email Addresses
ShinyHunters targeted Abbott-owned Exact Sciences in July 2026, exposing 10.9 million email addresses and associated personal and health information from its cancer diagnostics business.
7/1/2026 • Data Breaches & Exposure Events • General
Databreachtoday
ShinyHunters Threatens To Leak One Medical Patient Records
ShinyHunters threatened to publish alleged 8.8TB of One Medical patient data on June 22 after unauthorized access to third-party archived health records in June.
6/19/2026 • Data Breaches & Exposure Events • General
Lincoln Journal
AdaptHealth Breach May Have Exposed Patient And Health Data
AdaptHealth Corp. confirmed in June 2025 that a threat actor accessed cloud systems through compromised contractor credentials and exfiltrated potentially sensitive patient data in the United States.
8/15/2026 • Data Breaches & Exposure Events • General
SecurityWeek / Ionut Arghire
ShinyHunters Leaks 41GB Allegedly Stolen From Brinks Home
ShinyHunters allegedly published more than 41 gigabytes of Brinks Home data after the company disclosed an intrusion, using a Tor-based leak site.
8/3/2026 • Data Breaches & Exposure Events • General
BleepingComputer / Lawrence Abrams
McKesson Investigates ShinyHunters Claim Of Patient Data Theft
McKesson disclosed on August 25, 2026, in a United States regulatory filing, that unauthorized access to third-party applications led to alleged data exfiltration.
8/28/2026 • Data Breaches & Exposure Events • General
Cybernews
ShinyHunters Claims 8.8TB Breach At One Medical
ShinyHunters issued a dark web claim of 8.8TB stolen from One Medical, with a June 22 negotiation deadline, as medical data exposure risks remain unverified.
6/18/2026 • Data Breaches & Exposure Events • General
CyberInsider / Alex Lekander
ShinyHunters Claims McKesson Breach Exposed 284 Million Records
ShinyHunters claimed in the United States that McKesson data was stolen through third-party applications, prompting McKesson to investigate an alleged healthcare breach.
8/28/2026 • Data Breaches & Exposure Events • General
DataBreachToday
ShinyHunters Claims 7.1M Baxter Salesforce Records Stolen
ShinyHunters claimed Wednesday that 7.1 million Baxter International records were leaked after an alleged Salesforce theft, while Baxter investigated unauthorized third-party application activity.
8/21/2026 • Data Breaches & Exposure Events • General
DataBreachToday
ShinyHunters Claims 7.1M Salesforce Records Stolen From Baxter
ShinyHunters claimed in August 2026 that 7.1 million Salesforce records were stolen from Baxter International in a healthcare data incident involving third-party applications.
8/24/2026 • Data Breaches & Exposure Events • General