DentaQuest says a May 2026 network breach affected 15 million people, exposing Social Security numbers and dental or vision health information.
The post DentaQuest Breach Affects 15 Million in Largest US Health Data Breach Reported in 2026 appeared first on TechRepublic.
The ShinyHunters cybercrime group has taken responsibility for the recently disclosed data breach involving professional services firm Ernst & Young (EY), adding the company to its Tor-based leak site and threatening to publish the stolen data unless negotiations begin by July 31.
Earlier this month, EY notified several U.S. state Attorneys General that attackers had gained unauthorized access to a third-party service management platform used to support tax-related operations. According to the company’s filings, the intrusion occurred between March 28 and April 12, during which threat actors downloaded documents attached to customer support tickets.
“EY uses a third-party information technology service management platform to help EY information technology personnel provide support to EY teams performing tax-related work for clients. Support tickets submitted through the platform may include documents containing client tax information. On April 23, 2026, EY identified anomalous activity within that platform.” reads the data breach notification. ” “EY’s Information Security team immediately initiated its incident response procedure to determine the nature and scope of the incident, contain it, and begin remediation and recovery efforts. EY has worked with an independent cybersecurity firm to investigate the incident and confirm that the unauthorized access has been stopped, and our systems are now secure. Based on EY’s investigation and available evidence, between March 28, 2026, and April 12, 2026, an unauthorized third party accessed the platform referenced above and downloaded documents pertaining to a number of EY clients.”
The exposed information includes highly sensitive personal and financial data used for tax preparation, such as names, addresses, Social Security numbers, bank account details, payment card information, and other tax-related records. EY said the incident affected data stored within the external support platform rather than its core internal systems.
While the company has not disclosed how many individuals were impacted or publicly attributed the attack, it is offering affected customers 24 months of complimentary credit monitoring, identity monitoring, and identity restoration services. EY has also remained silent on whether it has been in contact with the attackers.
The claim by ShinyHunters adds to a growing list of high-profile victims attributed to the group. In recent months, the extortion gang has claimed responsibility for breaches affecting organizations such as DentaQuest, 7-Eleven, Medtronic, and campaigns targeting Oracle PeopleSoft and Salesforce environments.
The group is known for stealing large volumes of sensitive data and using the threat of public disclosure to pressure victims into paying a ransom.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, ShinyHunters)
Medtronic is notifying 3,834,294 individuals after a cyberattack by the ShinyHunters extortion group exposed personal and medical information.
In April 2026, Medtronic confirmed a cyberattack on its corporate IT systems after the hacker group ShinyHunters claimed to have stolen over 9 million records. The company did not share details on the security breach.
Medtronic is an international medical equipment giant with 90,000 employees and operations in 150 countries. It is the largest medical device maker in the world by revenue ($33.5 billion) and also develops healthcare technologies and therapies.
The company said an unauthorized party accessed data in some corporate IT systems. It found no impact on products, patient safety, operations, financial systems, or care delivery. The company noted its IT, product, and manufacturing networks are separate, and hospital networks remain independently managed and secure.
“Medtronic has determined that an unauthorized party accessed data in certain Medtronic corporate IT systems. We have not identified any impact to our products, patient safety, connections to our customers, our manufacturing and distribution operations, our financial reporting systems or our ability to meet patient needs.” reads the press release published by the company. “The networks that support our corporate IT systems, our products and our manufacturing and distribution operations are separate. Hospital customer networks remain separate from Medtronic IT networks and are secured and managed by customers’ IT teams.”
Medtronic states it had contained the breach and activated incident response with the help of external cybersecurity experts. It’s assessing if personal data was exposed and will notify affected individuals, offering them support.
On April 18, ShinyHunters added the firm to its Tor data leak site, claiming the theft of over 9 million records, including personal data and internal files. Initially, the group threatened to leak the data if the ransom was not paid by April 21, but the listing has since disappeared. The company is investigating and says it will notify and support affected individuals if data exposure is confirmed.
This week, the technology firm started sending notification letters to the impacted individuals. Medtronic said the breached data may include patients’ names, contact details, dates of birth, Social Security numbers, and health information. The company added that it has found no evidence the stolen information has been publicly released or exposed online.
“On April 15, 2026, Medtronic became aware of unusual activity on certain corporate IT systems. Medtronic launched an investigation with the assistance of leading third-party cybersecurity experts to determine the impact and scope of the incident. The investigation determined that from April 13 to April 19, 2026, an unauthorized actor accessed certain Medtronic corporate IT systems.” reads the data breach notification. “With the assistance of data review specialists, we have been working diligently to determine the types of information that may have been subject to unauthorized activity and to whom they relate. What Information Was Involved? As a patient with a Medtronic medical device, our company collects data related to you in order to provide important product-related updates and to meet our legal obligations. The investigation to date has determined that the following types of information may have been impacted: name, contact information, date of birth, Social Security number, and health-related information. We have no evidence that any of that information was posted publicly or exposed on the Internet.”
Medtronic is offering 24 months of free credit monitoring, dark web monitoring, and identity theft recovery services to those impacted.
“Medtronic is committed to and takes very seriously our responsibility to safeguard all data entrusted to us. As part of our ongoing commitment to the security of personal information in its care, Medtronic has implemented additional safeguards and continues to work with third-party cybersecurity experts to identify opportunities to further strengthen the security of its systems.” concludes the notification. “Medtronic has also worked with law enforcement and is notifying relevant regulatory authorities. In addition, we are offering you access to 24 months of complimentary credit monitoring, dark web monitoring (monitoring certain online sources for publication of personal information), and identity theft restoration services through Epiq. Details on the service and instructions for enrollment can be found in the enclosed Epiq – Privacy Solutions ID.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, data breach)
Madison Square Garden faces a 26M-record hack tied to visitor data, facial recognition, and security records from its venue operations, with fallout from the leak.
The post Madison Square Garden Hack Exposes 26 Million Visitor Records appeared first on TechRepublic.
Resecurity (USA) warns the education technology (EdTech) sector has become a prime target for cybercriminals, as attacks against educational institutions and related platforms continue to escalate. Recent high-profile incidents, including attacks by groups such as ShinyHunters and FulcrumSec, highlight the vulnerability of educational organizations and the increasing sophistication of cyber extortion tactics.
Today (June 16, 2026) — ShinyHunters announced new victims, including, but not limited to Glendale Community College, Moody Bible Institute, Illinois Central College, Houston City College. The gang also stole personal information from more than 137,000 school staff accounts in a Salesforce data theft attack that targeted the widely used Infinite Campus K-12 student information system in March. Infinite Campus is an education technology (EdTech) company that provides a student information system (SIS) to over 3,200 school districts across the United States, managing data for 11 million students in 46 states.
In another devastating incident, the group FulcrumSec has claimed responsibility for a massive ransomware attack targeting the Global Schools Foundation (GSF), an international network of educational institutions headquartered in Singapore. The attack, which occurred in early June 2026, resulted in large-scale data exfiltration from critical systems across GSF’s schools in multiple countries, disrupting operations, and leaving students and staff unable to access essential services.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, EdTech Faces)
Infinite Campus says a Salesforce breach exposed data tied to 137,000 school staff accounts, raising phishing and SaaS security concerns.
The post Infinite Campus: Salesforce Breach Exposed 137,000 Staff Records appeared first on TechRepublic.
ShinyHunters claims it stole 297GB of data from the Council of Europe, including payroll and medical records, but the organization has not confirmed a breach.
The post ShinyHunters Claims Council of Europe HR Data, Threatens Leak appeared first on TechRepublic.
Oracle issued emergency guidance for CVE-2026-35273, a critical PeopleSoft flaw exploited in a ShinyHunters-linked campaign targeting universities.
The post Oracle Warns PeopleSoft Customers After Critical Zero-Day Exploited appeared first on TechRepublic.
Source: X[/caption]
Such claims, if validated, could significantly expand the scope of the Canvas cybersecurity incident beyond initial disclosures. For now, the company maintains that its investigation is ongoing.
Entrar