Medtronic Already Facing Federal Lawsuits in Recent Hack

Medical device maker Medtronic is already facing at least a half-dozen proposed federal class action lawsuits days after the company confirmed that cybercriminals hacked into the manufacturer’s corporate IT systems. Plaintiffs include patients of the company’s cardiac devices and other products.

See Also: OnDemand | Navigating the SEC Rules for Enhanced Cybersecurity in IT and OT Environments

Ransomware gang ShinyHunters, which claimed it had stolen 9 million records from the company, on Friday no longer listed Medtronic its darkweb leak site as a victim.

Medtronic didn’t immediately respond to ISMG’s request for comment on the lawsuits and for additional details about the security incident.

The six punitive lawsuits, all filed in a Minnesota federal court and seeking financial damages, make similar allegations. That includes claims that Medtronic was negligent in failing to protect plaintiffs’ and class members’ sensitive personally identifiable information and protected health information from cybercriminals.

One of lawsuits, filed on Thursday, said that on April 17, ShinyHunters posted a claim on a Tor network site alleging that the gang had breached a Medtronic database. “The threat actor claimed to have obtained over 9 million records containing PII, along with additional terabytes of internal corporate data,” the lawsuit alleges.

A week later, on April 24, Medtronic issued a public statement and informed the U.S. Securities and Exchange Commission that the company’s corporate IT systems had been breached.

The company said in its corporate statement that it’s working to identify any personal information that may have been accessed and will provide notifications and support services to affected individuals as needed.

The class action litigation alleges that “as a result of Medtronic’s failure to implement and follow basic security procedures, plaintiffs’ and class members’ PII and PHI is now in the hands of criminals. Plaintiffs and class members face a substantial increased risk of identity theft, both currently and for the indefinite future.”

“The ramifications of Medtronic’s failure to keep plaintiffs’ and class members’ PII and PHI secure are long-lasting and severe. Once PII and PHI is stolen, fraudulent use of that information and damage to victims may continue for years. Fraudulent activity might not show up for months or even years thereafter,” the lawsuit alleges.

Minnesota-based Medtronic, which operates in 150 countries and serves 79 million people globally with its wide range of implantable cardiac, neurologic, robotic-assisted surgical devices and other products, reported revenue of $33.5 billion in fiscal 2025.

Sensitive Data Troves

The type of patient information some medical devices makers collect and store is vast, some experts said.

“Most people underestimate the data footprint on the manufacturer’s side,” said James Winebrenner, CEO of security firm Elisity. “Under FDA’s tracking rule at 21 CFR 821.25, manufacturers of certain implantable devices are required to maintain patient name, address, phone and Social Security number where available, all linked to the device’s serial number, the prescribing physician and the physician currently following the patient,” he said.

“In fact, manufacturers are the only party that can correlate a specific device serial number to a named patient at a named hospital, treated by a named surgeon,” Winebrenner said. “That correlation is what makes manufacturer-held data uniquely valuable to fraud crews and intelligence services.”

The hack on Medtronic is at least the fourth cyber incident disclosed in recent weeks involving a large U.S.-based medtech manufacturer, including a March 11 wiper attack on medical gear maker Stryker that disrupted the company’s manufacturing and distribution operation globally for nearly a month. Iranian hacktivist group Handala, which is widely suspected of being a front for Iran’s Ministry of Intelligence, claimed responsibility for the incident.

Stryker on Thursday told Wall Street analysts and investors that the cyberattack had a “big impact” on financial results in the first quarter because of the impact on manufacturing and distribution of the company’s various medtech product lines.

But Stryker executives said they expect the company’s yearly financials will be unaffected by the incident because demand of products did not decrease and all global functions were restored in early April (see: Breach Roundup: How Stryker’s Attack Affected Its First Quarter Finances).

As for Medtronic, in its April 24 filing to the SEC, the company said its investigation into the incident has not identified any impact to its products, patient safety, connections to customers, manufacturing and distribution operations, financial reporting systems, or ability to meet patient needs.

“In addition, the company does not currently expect the incident to have a material impact on its business or financial results,” the filing said.

The attacks also have potential implications for hospitals’ expansive portfolios of connected medical and other devices, which are now “the largest unmanaged attack surface in clinical environments,” Winebrenner said.

“Hospitals are running enormous device inventories on relatively flat networks: Imaging modalities still on legacy Windows because they’re tied to OEM support contracts, infusion pumps with hardcoded or shared credentials and remote-access pathways for vendors that aren’t fully inventoried until something goes wrong.”