Abbott investigates two incidents, one starting with a vished Entra account
Abbott confirmed unauthorized access to legacy Exact Sciences systems after a mid-June vishing attack compromised a Microsoft Entra single sign-on account. ShinyHunters claims a large data theft, unverified. A second, smaller incident used stolen customer credentials on a portal.
Abbott Laboratories confirmed unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business. The reported entry point is the part worth noting: a mid-June vishing attack against Abbott employees that compromised a Microsoft Entra single sign-on account.
ShinyHunters claims to have taken customer personal data running to tens of millions of rows, client notes covering doctor-patient conversations, medical orders, and data pulled from Entra, ServiceNow, SharePoint, Databricks, and Coupa. Abbott has confirmed the unauthorized access; the volume and content claims are the attacker's and remain unverified. Treat the numbers as an extortion posture until someone independent confirms them.
A second, separate incident involved the LabCentral customer portal, entered with compromised customer credentials by an actor calling itself ShadowByt3$. Abbott disputes its significance, saying the portal holds only publicly available technical reference documents.
Why it matters
One phone call to one employee, one SSO account, and the reach extends across five SaaS platforms. That is single sign-on working exactly as designed, in the wrong hands: the same property that makes it worth deploying makes one compromised identity a cross-platform incident.
ShinyHunters sits in The Com, the same loose collective behind the Entra passkey-enrollment vishing campaign, and this is now their signature: skip the malware, call the helpdesk or the user. Our Scattered Spider teardown covers the pattern in detail. The uncomfortable question it poses is not whether your MFA is strong, but what your helpdesk does when someone calls sounding stressed and senior. Note also that the compromised systems were legacy and acquired, which is where identity governance usually thins out.
Source: BleepingComputer
Related on Start with Identity
- BlogChick-fil-A's second credential stuffing breach in three years hit 13,322 loyalty accounts
Automated login attempts using credentials obtained from a third-party source, not a Chick-fil-A breach, compromised 13,322 Chick-fil-A One loyalty accounts ove
- BlogShinyHunters claims an Ernst & Young breach that started with someone else's stolen credentials
The extortion group says it used credentials obtained through a supply-chain attack, source undisclosed, to reach EY's Jira, GitHub, and Azure environments, and
- BlogA CVSS 10.0 bug let one user's Terraform token serve another user's request
HashiCorp's Terraform MCP Server failed to assign unique session identifiers in stateless HTTP mode, so a token supplied by one user could be reused for later r
- GlossaryAccount Takeover (ATO)
When an attacker gains control of a legitimate account, often via stolen credentials, phishing, or session theft. A leading cause of breaches and fraud. The dis
- GlossaryBreak-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a rea
- GuideConditional Access Policies: A Complete Implementation Guide for Microsoft Entra
Master Microsoft Entra conditional access with risk-based policies, device compliance rules, location-based restrictions, and real-world deployment patterns.