Abbott Investigates Cyber Incident in Cancer Diagnostics Business From Exact Sciences

Abbott is investigating a cyber incident involving unauthorized access to "a limited number of internal systems in our Cancer Diagnostics business only," the company said in a statement posted to its newsroom on July 16.

"This does not impact any business operations, product or product availability, manufacturing or lab operations, or our ability to serve patients," Abbott said. It added that no other Abbott businesses, sites or systems were affected and that "the legacy Exact Sciences systems are separate from Abbott's."

Legacy Exact Sciences systems

Abbott's cancer diagnostics business includes Exact Sciences, which the company acquired in a $21 billion deal earlier this year, MedTech Dive reported on July 17.

Abbott said it took immediate steps after learning of the access, engaged third-party cybersecurity experts and law enforcement, and was working to investigate the information accessed. "Based on what we know at this time, we do not expect any material impact on the business or financial results," the statement said.

The company did not say what kind of information was accessed and declined to tell MedTech Dive when the attack was discovered, the outlet reported.

Extortion claims and a second incident

Abbott confirmed the incident after the ShinyHunters extortion group added the company to its data leak site, BleepingComputer reported on July 17. The group initially threatened to publish data it said it had taken after July 18 unless Abbott negotiated, then extended that deadline to July 21, according to the outlet. ShinyHunters told BleepingComputer it got in through a vishing attack targeting several Abbott employees in mid-June. Those claims had not been verified, and neither group had released any data, the outlet said.

BleepingComputer also reported a separate claim from a threat actor calling itself ShadowByt3$, which said it breached Abbott's Core Laboratory diagnostics business through its LabCentral customer portal using compromised customer credentials. Abbott told the outlet it was aware of the "potential" incident but disputed the description of the data, saying that all data stored in the environment is public and not sensitive. "LabCentral is an externally facing third-party hosted portal used by Abbott's core laboratory diagnostics business," an Abbott spokesperson told BleepingComputer.

Abbott is the latest medtech company to disclose a cyberattack in recent months. Stryker, Intuitive, Medtronic, iRhythm and AdaptHealth have all reported incidents, and Stryker's March attack brought down its ordering, shipping and manufacturing for weeks, MedTech Dive reported.