Loading story…
A hacker using the alias 888 has advertised internal records allegedly stolen from Samsung Medison, a subsidiary of Samsung specializing in medical devices, on a cybercrime forum. The hacker claims the data was obtained through a breach of a third-party contractor and includes sensitive information such as source code, private keys, SMTP credentials, configuration files, hardcoded credentials, and personally identifiable information (PII) from a healthcare backup. The compromised data reportedly provides access to MSSQL and AWS S3 environments, with evidence suggesting backend database content, cloud storage data, SQL tables, user and employee records, internal logs, and exported cloud directories from Samsung Medison's healthcare environment. The hacker is seeking payment in Monero (XMR) and is offering the data as a one-time sale, raising significant privacy and security concerns due to the sensitive nature of the healthcare data involved.
Screenshots shared by the hacker and analyzed by security researchers indicate that the exposed data includes names, emails, country details, SQL records, and cloud logs tied to a healthcare setting, which could be misused for targeting, intrusion, or follow-up attacks. Samsung has been contacted for comment, but the authenticity of the data has not yet been confirmed. If verified, the breach could have serious implications for patient privacy and the security of medical information, especially given the potential for further exploitation or resale of the data on underground forums.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
A threat actor was reported offering allegedly stolen Samsung Medison data for sale, with the breach said to involve a third-party compromise rather than Samsung Medison's own systems. Multiple outlets reported the same claimed sale of data on underground or dark-web forums.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Medtronic said an unauthorized party accessed data in portions of its corporate IT environment and that it has contained the incident, activated response procedures, and engaged external cybersecurity experts. The company said it has not identified any impact on **products**, **patient safety**, customer connections, manufacturing and distribution operations, financial reporting systems, or its ability to meet patient needs, stressing that corporate IT, product, manufacturing, and hospital customer networks are segmented. The disclosure followed extortion claims tied to **ShinyHunters**, which said it stole more than **9 million records** containing personally identifiable information along with terabytes of internal corporate data and briefly listed Medtronic on its leak site before the entry disappeared. Medtronic said its investigation is ongoing to determine whether personal data was accessed and that it will notify affected individuals and provide support services if exposure is confirmed, while separate reporting also linked the incident to **Handala**, underscoring uncertainty around attribution even as the breach itself has been confirmed.
Jul 3, 2026
Medtronic disclosed that unauthorized actors accessed certain corporate IT systems between April 13 and April 19, exposing personal and health-related information tied to **3,834,294 individuals**. The company said the incident was detected after unusual activity on April 15 and attributed in public reporting to the **ShinyHunters** extortion group, which claimed to have stolen about **9 million records** and briefly listed Medtronic on its Tor-based leak site before the post disappeared. Exposed data may include names, contact details, dates of birth, Social Security numbers, and other health-related information. Medtronic said it found **no impact** on medical devices, patient safety, hospital customer networks, manufacturing and distribution operations, financial systems, or care delivery, and added that it has no evidence the stolen data was publicly released online. The company has engaged external cybersecurity experts, notified law enforcement and regulators, and is warning affected people to watch for phishing, social engineering, and unauthorized account activity while offering **24 months** of credit monitoring, dark web monitoring, and identity theft recovery services.
Jul 8, 2026