Medela data breach: 423K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2026-09-30
In September 2026, Swiss medical device company Medela was the target of a ShinyHunters "pay or leak" extortion campaign. The data allegedly obtained in the breach was later published publicly and included 424k unique email addresses belonging predominantly to healthcare professionals, Medela staff and leads. The exposed data consisted primarily of corporate contact information, including names, physical addresses and phone numbers, with some records also containing associated support tickets. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses, salutations, support tickets. The breach dates from Sep 7, 2026; Have I Been Pwned loaded it on Sep 30, 2026.
What to do
- If you had a Medela account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
