ShinyHunters Claims 30M Records from Abbott Cancer Diagnostics via Entra SSO Vishing; Second Actor Hits LabCentral API Simultaneously

ShinyHunters breached Abbott Laboratories' legacy Exact Sciences cancer diagnostics systems in mid-June via a vishing campaign that compromised a corporate Microsoft Entra SSO account, then exfiltrated data from connected SaaS platforms. The group claims 30 million customer rows including approximately one million Social Security numbers, and placed Abbott on its leak site with a deadline later extended to July 21. A concurrent, independent actor dubbed ShadowByt3$ separately claims API-based exfiltration from Abbott's LabCentral portal beginning July 4 — illustrating how a single high-value target can attract parallel threat actors exploiting different attack surfaces.

The group claims 30 million customer rows including approximately one million Social Security numbers, and placed Abbott on its leak site with a deadline later extended to July 21.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.