Baxter International

Summary

Baxter International reported a cybersecurity incident involving unauthorized activity in certain third‑party applications, which it investigated with external experts. The ShinyHunters group claimed responsibility, stating it exfiltrated approximately 7.1 million Salesforce records containing personally identifiable information and later leaked the data after negotiations failed. The company said the breach did not affect patient services, product functionality, or business continuity and does not expect a material financial impact. The group has a history of targeting healthcare organizations, including prior attacks on OneMedical, DentaQuest and Medtronic.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On August 13 2026 Baxter International issued a statement indicating that unauthorized activity had been detected within certain third‑party applications, prompting the activation of its cybersecurity response procedures and the launch of an investigation assisted by third‑party cybersecurity and digital forensics experts. The company said the investigation was ongoing to determine the types and amount of information that may have been accessed or acquired. On August 14 2026 the ShinyHunters group added an entry to its dark web data leak site claiming responsibility for the intrusion and gave Baxter an August 17 2026 deadline to negotiate payment, threatening to release the stolen data if the demand was not met. When the deadline passed without a reported agreement, ShinyHunters published the alleged data for download on August 19 2026.

Baxter has not confirmed the specific nature of the stolen information, stating only that the attack involved certain third‑party applications. ShinyHunters claims that approximately 7.1 million Salesforce records were exfiltrated, some of which contain personally identifiable information, though Baxter notes that the number of records does not necessarily equate to the number of affected individuals. The company emphasized that the incident did not disrupt patient services or business continuity, that its products, connected solutions and customer‑facing technologies remained operational, and that it does not anticipate a material impact on its financial results or operations. Baxter said it will provide further updates as additional information is confirmed.

ShinyHunters is described as one of the most active data theft and extortion groups, frequently targeting large organizations and having claimed several healthcare victims. Earlier in June 2026 the group asserted it had taken 8.8 terabytes of data from Amazon‑owned OneMedical, including protected health information of 153,000 patients, and 234 GB from DentaQuest, affecting roughly 2.6 million individuals. In July 2026 ShinyHunters was linked to an incident at Medtronic involving the protected health information of 3.8 million patients, and the group has also been associated with breaches at iRhythm, AdaptHealth and Him & Hers. The increase in healthcare‑sector attacks led Health‑ISAC to issue an alert to the healthcare and public health community in July 2026 regarding the ShinyHunters threat.

Sources

Sources available to members: 1 source.