Exact Sciences breach exposes data of nearly 11 million in extortion campaign

Data from a breach at cancer-screening company Exact Sciences, now part of Abbott, was indexed by Have I Been Pwned with about 10.9 million unique email addresses. The extortion group ShinyHunters claimed the intrusion, saying it reached internal legacy systems and then pivoted from a corporate single-sign-on account into connected cloud services such as Microsoft 365, Salesforce, and others to steal data. It is part of a wider ShinyHunters wave hitting medical-technology companies. Abbott is investigating and disputed the attacker's characterization of some data. The pattern, one stolen sign-on unlocking many linked services, is now a recurring route to large healthcare breaches.

Check

People who used Exact Sciences services should watch for breach notices and health-themed phishing, and organizations should map which cloud services a single corporate sign-on can unlock.

Affected

Roughly 11 million people whose data sat in Exact Sciences systems and connected cloud services; attackers used one corporate sign-on to reach linked platforms, a pattern behind repeated large medical breaches.

Fix

Enforce phishing-resistant MFA on single-sign-on, scope what each connected cloud app can access, monitor for bulk exports across integrated services, and prepare for extortion-driven leaks of healthcare data.