Exact Sciences (Abbott) data breach
Was I affected?
Exact Sciences (Abbott) confirmed a breach affecting about 10.9 million email addresses, exposing names, email addresses, phone numbers and addresses. You may be affected if you used Cologuard or other Exact Sciences tests or are a provider who ordered them; watch for a notice from Abbott/Exact Sciences.
| Announced | Jul 16, 2026 |
|---|---|
| When it happened | Mid-June to July 2026 |
| Email addresses exposed | 10.9 million |
| Data exposed | Names, Email addresses, Phone numbers, Addresses, Dates of birth and Medical information |
| Status | Confirmed by the company or a regulator filing |
What happened
Abbott, which now owns the cancer diagnostics business of Cologuard maker Exact Sciences, confirmed in July 2026 that attackers accessed legacy Exact Sciences systems after ShinyHunters tricked employees by phone. ShinyHunters later leaked data that Have I Been Pwned says holds about 10.9 million unique emails belonging to customers, patients and providers, with names, addresses, phone numbers, birth dates and health data. Abbott said some files contained personal health information and that notifications would follow its review.
What should I do?
- Treat emails, texts and calls that mention Cologuard, test results or billing as suspect; don't click links or share codes, and contact the company through its official app or website.
- Read every Explanation of Benefits from your health insurer and report any visit, test or prescription you never had.
- Enroll in any monitoring offered once Abbott/Exact Sciences sends notice letters.
- Freeze your credit for free at Equifax, Experian and TransUnion so no one can open new accounts in your name.
Check whether your email address is in this breach on Have I Been Pwned (breach data from haveibeenpwned.com, CC BY 4.0).
Check the other services you use →
Sources
- Abbott probes two cyber incidents amid extortion claims · BleepingComputer (news)
- ShinyHunters called cancer diagnostics biz and tricked staffers into giving them access. Now they've dumped 10.9M email addresses · The Register (news)