Cyber Incident Victim: Cook Medical
Timeline
Summary
Cook Medical reported that an employee was deceived by a social engineering attack, allowing an outside party to gain access to some company systems. The accessed information included contact details for U.S. and Canadian customers, records of communications within the Salesforce platform, internal business files, employee names and company email addresses. The company stated there was no evidence that sensitive or protected data was accessed and that its products, manufacturing, and ability to serve patients were unaffected, with operations continuing normally. It said it contained the unauthorized access quickly, notified affected customers and employees, and provided guidance on recognizing and avoiding further scams.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 2, 2026, an employee of Cook Medical inadvertently granted an outside party access to certain company systems after being deceived by a social engineering scam. The unauthorized access was identified by the company's information security team on the same day it occurred. Containment measures were applied promptly, and the breach was contained within the same day. Cook Medical stated that the incident was discovered quickly and that its reporting and response teams functioned as intended.
The systems accessed included contact information for customers in the United States and Canada, records of communications with Cook employees stored in the Salesforce platform, some internal business files, as well as employee names and company email addresses. According to the company's review, there was no evidence that sensitive or protected data was accessed or exfiltrated. Cook Medical emphasized that the incident did not affect its products, manufacturing processes, or its ability to serve patients and customers, and that overall operations continued to run normally.
Following containment, Cook Medical began notifying affected customers and employees about the incident and provided guidance on how to recognize and avoid further scams. The company reiterated that its information security infrastructure, reporting mechanisms, and response teams performed as expected during the event. Cook Medical concluded its public statement by noting that, based on the review to date, there is no indication of compromise to sensitive or protected data.