In July 2026, cancer diagnostics firm Exact Sciences (now owned by Abbott Laboratories) was hit by a ShinyHunters “pay or leak” extortion campaign. After the company reportedly did not meet ransom demands, the group publicly released the stolen data, which spanned roughly 10.9 million unique email addresses tied to customers, patients and healthcare providers, along with names, addresses, phone numbers and sensitive health records.
Abbott issued a public notice confirming that some impacted files contained personal and health information, with further detail to follow after its review. The exposure of email addresses combined with health data creates significant downstream risk for targeted phishing, credential-stuffing and medical identity fraud.
What to take away: exposed email addresses at this scale become fuel for account-takeover and social-engineering attacks. Organizations should watch for credential reuse against corporate accounts and reinforce MFA and phishing-resistant authentication for any potentially affected users.