Medtronic data breach: what happened and what to do

What happened

Medtronic, the medical device maker, says it became aware of unusual activity on certain corporate IT systems on April 15, 2026. Its investigation found that an unauthorized actor had access from April 13 to April 19, 2026. Medtronic says there was no impact on its products, patient safety, customer connectivity, manufacturing or distribution, and that its corporate IT networks are separate from its product and manufacturing networks.

The extortion group ShinyHunters had claimed about 9 million Medtronic records containing personal information and internal corporate data. Medtronic is notifying 3,834,294 people, according to reports on its notices. Medtronic says it has no evidence that the information was posted publicly or exposed on the internet. One report says the group's listing was removed later in the month.

State attorney general filings carry only a slice of that count, such as the 64,035 residents listed in Washington. That's one state, not the total.

What was exposed

The notice lists names, contact information, dates of birth, Social Security numbers and health-related information. The people affected include patients and others whose details Medtronic held. What was exposed varies by person, so your letter is the guide to your own case.

What that lets criminals do

A date of birth and Social Security number together support identity theft: new credit in your name, a fake tax return, a phone contract you never signed. Those frauds can surface long after the breach, because a date of birth and a Social Security number don't change. That is why a credit freeze matters more here than a password change. A freeze costs nothing, takes a few minutes at each bureau, and stays in place until you lift it yourself.

Health-related information adds a second risk. A message that mentions a device or a condition you really have is far more convincing than generic spam, so phishing that quotes real details is the main thing to watch for. If your contact information was included, expect calls and texts as well as email.

The company's response

Medtronic notified affected people by letter and filed with state regulators, including the California Attorney General, which hosts the consumer letter. It says it has no evidence that the data was published. Check your letter for any credit monitoring offer and its enrollment deadline, since terms are set in each notice.

How to protect yourself

Freeze your credit at the three bureaus if a Social Security number was listed. Read insurance statements for care you didn't receive. Be careful with any message that mentions Medtronic, a device or a recall, and confirm it through the company's official site. If you use a Medtronic patient portal or app login, change that password and any place you reused it, and turn on two-factor login.